Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c62e0bc authored by Gao Feng's avatar Gao Feng Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: Expectations must have a conntrack helper area 



The expect check function __nf_ct_expect_check() asks the master_help is
necessary. So it is unnecessary to go ahead in ctnetlink_alloc_expect
when there is no help.

Actually the commit bc01befd ("netfilter: ctnetlink: add support for
user-space expectation helpers") permits ctnetlink create one expect
even though there is no master help. But the latter commit 3d058d7b
("netfilter: rework user-space expectation helper support") disables it
again.

Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6e699867

net/netfilter/nf_conntrack_netlink.c

+8 −19
Original line number Diff line number Diff line
@@ -3038,6 +3038,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 
	struct nf_conn_help *help;

	int err;



	help = nfct_help(ct);

	if (!help)

		return ERR_PTR(-EOPNOTSUPP);



	if (cda[CTA_EXPECT_CLASS] && helper) {

		class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));

		if (class > helper->expect_class_max)
@@ -3047,25 +3051,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 
	if (!exp)

		return ERR_PTR(-ENOMEM);



	help = nfct_help(ct);

	if (!help) {

		if (!cda[CTA_EXPECT_TIMEOUT]) {

			err = -EINVAL;

			goto err_out;

		}

		exp->timeout.expires =

		  jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;



		exp->flags = NF_CT_EXPECT_USERSPACE;

		if (cda[CTA_EXPECT_FLAGS]) {

			exp->flags |=

				ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

		}

	} else {

	if (cda[CTA_EXPECT_FLAGS]) {

		exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

		exp->flags &= ~NF_CT_EXPECT_USERSPACE;

		} else

	} else {

		exp->flags = 0;

	}

	if (cda[CTA_EXPECT_FN]) {