netfilter: handle NF_REPEAT from nf_conntrack_in()

NF_REPEAT is only needed from nf_conntrack_in() under a very specific
case required by the TCP protocol tracker, we can handle this case
without returning to the core hook path. Handling of NF_REPEAT from the
nf_reinject() is left untouched.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 2 insertions, 6 deletions

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 31045ef44a82..9b8a028b7dad 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -725,12 +725,8 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                         skb->nfctinfo = IP_CT_NEW;
                 }
 
-                /* Repeat if requested, see nf_iterate(). */
-                do {
-                        err = nf_conntrack_in(net, info->family,
-                                              NF_INET_PRE_ROUTING, skb);
-                } while (err == NF_REPEAT);
-
+                err = nf_conntrack_in(net, info->family,
+                                      NF_INET_PRE_ROUTING, skb);
                 if (err != NF_ACCEPT)
                         return -ENOENT;