BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 05:31:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

[NETFILTER]: conntrack: don't call helpers for related ICMP messages

Browse Source 
None of the existing helpers expects to get called for related ICMP
packets and some even drop them if they can't parse them.

Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Patrick McHardy authored and David S. Miller committed 2006-06-17 21:28:55 -07:00
1 parent 404bdbfd24
commit 6442f1cf89
3 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

net/ipv4/netfilter/ip_conntrack_standalone.c
+1 -1
View File
@@ -417,7 +417,7 @@ static unsigned int ip_conntrack_help(unsigned int hooknum,
/* This is where we call the helper: as the packet goes out. */
ct = ip_conntrack_get(*pskb, &ctinfo);
if (ct && ct->helper) {
if (ct && ct->helper && ctinfo != IP_CT_RELATED + IP_CT_IS_REPLY) {
unsigned int ret;
ret = ct->helper->help(pskb, ct, ctinfo);
if (ret != NF_ACCEPT)
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+1 -1
View File
@@ -145,7 +145,7 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
/* This is where we call the helper: as the packet goes out. */
ct = nf_ct_get(*pskb, &ctinfo);
if (!ct)
if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
return NF_ACCEPT;
help = nfct_help(ct);
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+1 -1
View File
@@ -189,7 +189,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
/* This is where we call the helper: as the packet goes out. */
ct = nf_ct_get(*pskb, &ctinfo);
if (!ct)
if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
goto out;
help = nfct_help(ct);