Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 534473c6 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: honor CTA_MARK_MASK when setting ctmark 



Useful to only set a particular range of the conntrack mark while
leaving exisiting parts of the value alone, e.g. when setting
conntrack marks via NFQUEUE.

Follows same scheme as MARK/CONNMARK targets, i.e. the mask defines
those bits that should be altered.  No mask is equal to '~0', ie.
the old value is replaced by new one.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a42b99a6

net/netfilter/nf_conntrack_netlink.c

+10 −2
Original line number Diff line number Diff line
@@ -2118,8 +2118,16 @@ ctnetlink_nfqueue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct) 
			return err;

	}

#if defined(CONFIG_NF_CONNTRACK_MARK)

	if (cda[CTA_MARK])

		ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

	if (cda[CTA_MARK]) {

		u32 mask = 0, mark, newmark;

		if (cda[CTA_MARK_MASK])

			mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK]));



		mark = ntohl(nla_get_be32(cda[CTA_MARK]));

		newmark = (ct->mark & mask) ^ mark;

		if (newmark != ct->mark)

			ct->mark = newmark;

	}

#endif

	return 0;

}