Commit b1e93a68 authored Mar 16, 2009 by Pablo Neira Ayuso Committed by Patrick McHardy Mar 16, 2009

netfilter: conntrack: don't deliver events for racy packets



This patch skips the delivery of conntrack events if the packet
was drop due to a race condition in the conntrack insertion.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>

parent 325fb5b4

include/net/netfilter/nf_conntrack_core.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -62,6 +62,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
		if (ct && ct != &nf_conntrack_untracked) {
		if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
		ret = __nf_conntrack_confirm(skb);
		if (likely(ret == NF_ACCEPT))
		nf_ct_deliver_cached_events(ct);
		}
		return ret;