Commit 00a3101f authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso

netfilter: nfnetlink_queue: reject verdict request from different portid

Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
request when the portid is not same with the initial portid(maybe
from another process).

Fixes: 97d32cf9 ("netfilter: nfnetlink_queue: batch verdict support")
Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b18bcb00
...@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, ...@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
struct nfnl_queue_net *q = nfnl_queue_pernet(net); struct nfnl_queue_net *q = nfnl_queue_pernet(net);
int err; int err;
queue = instance_lookup(q, queue_num); queue = verdict_instance_lookup(q, queue_num,
if (!queue) NETLINK_CB(skb).portid);
queue = verdict_instance_lookup(q, queue_num,
NETLINK_CB(skb).portid);
if (IS_ERR(queue)) if (IS_ERR(queue))
return PTR_ERR(queue); return PTR_ERR(queue);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment