Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fecc1133 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Patrick McHardy
Browse files

netfilter: ctnetlink: fix wrong message type in user updates 



This patch fixes the wrong message type that are triggered by
user updates, the following commands:

(term1)# conntrack -I -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state LISTEN
(term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_SENT
(term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_RECV

only trigger event message of type NEW, when only the first is NEW
while others should be UPDATE.

(term2)# conntrack -E
    [NEW] tcp      6 10 LISTEN src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0
    [NEW] tcp      6 10 SYN_SENT src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0
    [NEW] tcp      6 10 SYN_RECV src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0

This patch also removes IPCT_REFRESH from the bitmask since it is
not of any use.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 280f37af

net/netfilter/nf_conntrack_netlink.c

+20 −28
Original line number Diff line number Diff line
@@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[]) 
	return 0;

}



static inline void

ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)

{

	unsigned int events = 0;



	if (test_bit(IPS_EXPECTED_BIT, &ct->status))

		events |= IPCT_RELATED;

	else

		events |= IPCT_NEW;



	nf_conntrack_event_report(IPCT_STATUS |

				  IPCT_HELPER |

				  IPCT_REFRESH |

				  IPCT_PROTOINFO |

				  IPCT_NATSEQADJ |

				  IPCT_MARK |

				  events,

				  ct,

				  pid,

				  report);

}



static struct nf_conn *

ctnetlink_create_conntrack(struct nlattr *cda[],

			   struct nf_conntrack_tuple *otuple,
@@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
		err = -ENOENT;

		if (nlh->nlmsg_flags & NLM_F_CREATE) {

			struct nf_conn *ct;

			enum ip_conntrack_events events;



			ct = ctnetlink_create_conntrack(cda, &otuple,

							&rtuple, u3);
@@ -1383,8 +1362,17 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
			err = 0;

			nf_conntrack_get(&ct->ct_general);

			spin_unlock_bh(&nf_conntrack_lock);

			ctnetlink_event_report(ct,

					       NETLINK_CB(skb).pid,

			if (test_bit(IPS_EXPECTED_BIT, &ct->status))

				events = IPCT_RELATED;

			else

				events = IPCT_NEW;



			nf_conntrack_event_report(IPCT_STATUS |

						  IPCT_HELPER |

						  IPCT_PROTOINFO |

						  IPCT_NATSEQADJ |

						  IPCT_MARK | events,

						  ct, NETLINK_CB(skb).pid,

						  nlmsg_report(nlh));

			nf_ct_put(ct);

		} else
@@ -1404,8 +1392,12 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
		if (err == 0) {

			nf_conntrack_get(&ct->ct_general);

			spin_unlock_bh(&nf_conntrack_lock);

			ctnetlink_event_report(ct,

					       NETLINK_CB(skb).pid,

			nf_conntrack_event_report(IPCT_STATUS |

						  IPCT_HELPER |

						  IPCT_PROTOINFO |

						  IPCT_NATSEQADJ |

						  IPCT_MARK,

						  ct, NETLINK_CB(skb).pid,

						  nlmsg_report(nlh));

			nf_ct_put(ct);

		} else