Commit b1e93a68 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Patrick McHardy

netfilter: conntrack: don't deliver events for racy packets

This patch skips the delivery of conntrack events if the packet
was drop due to a race condition in the conntrack insertion.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 325fb5b4
...@@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb) ...@@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
if (ct && ct != &nf_conntrack_untracked) { if (ct && ct != &nf_conntrack_untracked) {
if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
ret = __nf_conntrack_confirm(skb); ret = __nf_conntrack_confirm(skb);
nf_ct_deliver_cached_events(ct); if (likely(ret == NF_ACCEPT))
nf_ct_deliver_cached_events(ct);
} }
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment