Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e098360f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Patrick McHardy
Browse files

netfilter: ctnetlink: cleanup conntrack update preliminary checkings 



This patch moves the preliminary checkings that must be fulfilled
to update a conntrack, which are the following:

 * NAT manglings cannot be updated
 * Changing the master conntrack is not allowed.

This patch is a cleanup.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 7ec47496

net/netfilter/nf_conntrack_netlink.c

+4 −11
Original line number Diff line number Diff line
@@ -1062,6 +1062,10 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[]) 
{

	int err;



	/* only allow NAT changes and master assignation for new conntracks */

	if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])

		return -EOPNOTSUPP;



	if (cda[CTA_HELP]) {

		err = ctnetlink_change_helper(ct, cda);

		if (err < 0)
@@ -1323,17 +1327,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
	if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {

		struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);



		/* we only allow nat config for new conntracks */

		if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {

			err = -EOPNOTSUPP;

			goto out_unlock;

		}

		/* can't link an existing conntrack to a master */

		if (cda[CTA_TUPLE_MASTER]) {

			err = -EOPNOTSUPP;

			goto out_unlock;

		}



		err = ctnetlink_change_conntrack(ct, cda);

		if (err == 0) {

			nf_conntrack_get(&ct->ct_general);