Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa0c2c68 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: reject new conntrack request with different l4proto 



Currently, user can add a conntrack with different l4proto via nfnetlink.
For example, original tuple is TCP while reply tuple is SCTP. This is
invalid combination, we should report EINVAL to userspace.

Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 00a3101f

net/netfilter/nf_conntrack_netlink.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl, 




			if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])

			if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])

				return -EINVAL;

				return -EINVAL;

			if (otuple.dst.protonum != rtuple.dst.protonum)

				return -EINVAL;





			ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,

			ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,

							&rtuple, u3);

							&rtuple, u3);