Commit ecfcdfec authored Sep 09, 2016 by Pablo Neira Ayuso

netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup()



nf_nat_setup_info() returns NF_* verdicts, so convert them to error
codes that is what ctnelink expects. This has passed overlook without
having any impact since this nf_nat_setup_info() has always returned
NF_ACCEPT so far. Since 870190a9 ("netfilter: nat: convert nat bysrc
hash to rhashtable"), this is problem.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent d1a6cba5

net/netfilter/nf_nat_core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -807,7 +807,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
		if (err < 0)
		return err;

		return nf_nat_setup_info(ct, &range, manip);
		return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;
		}
		#else
		static int