Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec8d5409 authored by Christoph Paasch's avatar Christoph Paasch Committed by Patrick McHardy
Browse files

netfilter: conntrack: fix dropping packet after l4proto->packet() 



We currently use the negative value in the conntrack code to encode
the packet verdict in the error. As NF_DROP is equal to 0, inverting
NF_DROP makes no sense and, as a result, no packets are ever dropped.

Signed-off-by: default avatarChristoph Paasch <christoph.paasch@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 626ba8fb

net/netfilter/nf_conntrack_core.c

+1 −1
Original line number Diff line number Diff line
@@ -726,7 +726,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
	NF_CT_ASSERT(skb->nfct);



	ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);

	if (ret < 0) {

	if (ret <= 0) {

		/* Invalid: inverse of the return code tells

		 * the netfilter core what to do */

		pr_debug("nf_conntrack_in: Can't track with proto module\n");

net/netfilter/nf_conntrack_proto_tcp.c

+2 −2
Original line number Diff line number Diff line
@@ -859,7 +859,7 @@ static int tcp_packet(struct nf_conn *ct, 
			 */

			if (nf_ct_kill(ct))

				return -NF_REPEAT;

			return -NF_DROP;

			return NF_DROP;

		}

		/* Fall through */

	case TCP_CONNTRACK_IGNORE:
@@ -892,7 +892,7 @@ static int tcp_packet(struct nf_conn *ct, 
				nf_log_packet(pf, 0, skb, NULL, NULL, NULL,

					  "nf_ct_tcp: killing out of sync session ");

			nf_ct_kill(ct);

			return -NF_DROP;

			return NF_DROP;

		}

		ct->proto.tcp.last_index = index;

		ct->proto.tcp.last_dir = dir;