Commit ad18d7bf authored by Michal 'vorner' Vaner's avatar Michal 'vorner' Vaner Committed by Pablo Neira Ayuso

netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT

NF_REPEAT places the packet at the beginning of the iptables chain
instead of accepting or rejecting it right away. The packet however will
reach the end of the chain and continue to the end of iptables
eventually, so it needs the same handling as NF_ACCEPT and NF_DROP.

Fixes: 368982cd ("netfilter: nfnetlink_queue: resolve clash for unconfirmed conntracks")
Signed-off-by: default avatarMichal 'vorner' Vaner <michal.vaner@avast.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 99e25d07
...@@ -233,6 +233,7 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) ...@@ -233,6 +233,7 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
int err; int err;
if (verdict == NF_ACCEPT || if (verdict == NF_ACCEPT ||
verdict == NF_REPEAT ||
verdict == NF_STOP) { verdict == NF_STOP) {
rcu_read_lock(); rcu_read_lock();
ct_hook = rcu_dereference(nf_ct_hook); ct_hook = rcu_dereference(nf_ct_hook);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment