Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2a75007 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: destroy functions need to free queued packets 



queued skbs might be using conntrack extensions that are being removed,
such as timeout.  This happens for skbs that have a skb->nfct in
unconfirmed state (i.e., not in hash table yet).

This is destructive, but there are only two use cases:
 - module removal (rare)
 - netns cleanup (most likely no conntracks exist, and if they do,
   they are removed anyway later on).

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 84657984

net/netfilter/nf_conntrack_core.c

+4 −0
Original line number Diff line number Diff line
@@ -56,6 +56,8 @@ 
#include <net/netfilter/nf_nat_helper.h>

#include <net/netns/hash.h>



#include "nf_internals.h"



#define NF_CONNTRACK_VERSION	"0.5.0"



int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
@@ -1692,6 +1694,7 @@ void nf_ct_unconfirmed_destroy(struct net *net) 


	if (atomic_read(&net->ct.count) > 0) {

		__nf_ct_unconfirmed_destroy(net);

		nf_queue_nf_hook_drop(net);

		synchronize_net();

	}

}
@@ -1737,6 +1740,7 @@ nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data) 
		if (atomic_read(&net->ct.count) == 0)

			continue;

		__nf_ct_unconfirmed_destroy(net);

		nf_queue_nf_hook_drop(net);

	}

	rtnl_unlock();

net/netfilter/nf_queue.c

+1 −0
Original line number Diff line number Diff line
@@ -109,6 +109,7 @@ unsigned int nf_queue_nf_hook_drop(struct net *net) 


	return count;

}

EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);



static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,

		      struct nf_hook_entry *hook_entry, unsigned int queuenum)