openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: ctnetlink: fix wrong message type in user updates 

This patch fixes the wrong message type that are triggered by
user updates, the following commands:

(term1)# conntrack -I -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state LISTEN
(term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_SENT
(term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_RECV

only trigger event message of type NEW, when only the first is NEW
while others should be UPDATE.

(term2)# conntrack -E
    [NEW] tcp      6 10 LISTEN src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0
    [NEW] tcp      6 10 SYN_SENT src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0
    [NEW] tcp      6 10 SYN_RECV src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0

This patch also removes IPCT_REFRESH from the bitmask since it is
not of any use.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Pablo Neira Ayuso 2009-05-05 17:48:26 +02:00 committed by Patrick McHardy
parent 280f37afa2
commit fecc1133b6
1 changed files with 20 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
net/netfilter/nf_conntrack_netlink.c
View File

@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
return 0; return 0;
} }
static inline void
ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
{
unsigned int events = 0;
if (test_bit(IPS_EXPECTED_BIT, &ct->status))
events |= IPCT_RELATED;
else
events |= IPCT_NEW;
nf_conntrack_event_report(IPCT_STATUS |
IPCT_HELPER |
IPCT_REFRESH |
IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK |
events,
ct,
pid,
report);
}
static struct nf_conn * static struct nf_conn *
ctnetlink_create_conntrack(struct nlattr *cda[], ctnetlink_create_conntrack(struct nlattr *cda[],
struct nf_conntrack_tuple *otuple, struct nf_conntrack_tuple *otuple,
@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
err = -ENOENT; err = -ENOENT;
if (nlh->nlmsg_flags & NLM_F_CREATE) { if (nlh->nlmsg_flags & NLM_F_CREATE) {
struct nf_conn *ct; struct nf_conn *ct;
enum ip_conntrack_events events;
ct = ctnetlink_create_conntrack(cda, &otuple, ct = ctnetlink_create_conntrack(cda, &otuple,
&rtuple, u3); &rtuple, u3);
@ -1383,9 +1362,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
err = 0; err = 0;
nf_conntrack_get(&ct->ct_general); nf_conntrack_get(&ct->ct_general);
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
ctnetlink_event_report(ct, if (test_bit(IPS_EXPECTED_BIT, &ct->status))
NETLINK_CB(skb).pid, events = IPCT_RELATED;
nlmsg_report(nlh)); else
events = IPCT_NEW;
nf_conntrack_event_report(IPCT_STATUS |
IPCT_HELPER |
IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK | events,
ct, NETLINK_CB(skb).pid,
nlmsg_report(nlh));
nf_ct_put(ct); nf_ct_put(ct);
} else } else
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
@ -1404,9 +1392,13 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
if (err == 0) { if (err == 0) {
nf_conntrack_get(&ct->ct_general); nf_conntrack_get(&ct->ct_general);
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);
ctnetlink_event_report(ct, nf_conntrack_event_report(IPCT_STATUS |
NETLINK_CB(skb).pid, IPCT_HELPER |
nlmsg_report(nlh)); IPCT_PROTOINFO |
IPCT_NATSEQADJ |
IPCT_MARK,
ct, NETLINK_CB(skb).pid,
nlmsg_report(nlh));
nf_ct_put(ct); nf_ct_put(ct);
} else } else
spin_unlock_bh(&nf_conntrack_lock); spin_unlock_bh(&nf_conntrack_lock);