]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nf_conntrack: Add allow_clash to generic protocol handler
authorYuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
Fri, 19 Dec 2025 11:53:51 +0000 (20:53 +0900)
committerSasha Levin <sashal@kernel.org>
Wed, 4 Mar 2026 12:20:26 +0000 (07:20 -0500)
commit0dcef1cbcdff25e0ef2ae0b9e464f036278dd0f4
treec18e9addd82f936e4f3e9f2eec33324e631cdd86
parent43aecb9bab1a97a13ac0ec4f153f6a28f0270d4c
netfilter: nf_conntrack: Add allow_clash to generic protocol handler

[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]

The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
 ("netfilter: conntrack: introduce clash resolution on insertion race"),
sets allow_clash=true in the UDP/UDPLITE protocol handler
but does not set it in the generic protocol handler.

As a result, packets composed of connectionless protocols at each layer,
such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.

To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.

Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_conntrack_proto_generic.c