Commit ec8d5409 authored by Christoph Paasch's avatar Christoph Paasch Committed by Patrick McHardy

netfilter: conntrack: fix dropping packet after l4proto->packet()

We currently use the negative value in the conntrack code to encode
the packet verdict in the error. As NF_DROP is equal to 0, inverting
NF_DROP makes no sense and, as a result, no packets are ever dropped.
Signed-off-by: default avatarChristoph Paasch <christoph.paasch@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 626ba8fb
...@@ -726,7 +726,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, ...@@ -726,7 +726,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
NF_CT_ASSERT(skb->nfct); NF_CT_ASSERT(skb->nfct);
ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum); ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
if (ret < 0) { if (ret <= 0) {
/* Invalid: inverse of the return code tells /* Invalid: inverse of the return code tells
* the netfilter core what to do */ * the netfilter core what to do */
pr_debug("nf_conntrack_in: Can't track with proto module\n"); pr_debug("nf_conntrack_in: Can't track with proto module\n");
......
...@@ -859,7 +859,7 @@ static int tcp_packet(struct nf_conn *ct, ...@@ -859,7 +859,7 @@ static int tcp_packet(struct nf_conn *ct,
*/ */
if (nf_ct_kill(ct)) if (nf_ct_kill(ct))
return -NF_REPEAT; return -NF_REPEAT;
return -NF_DROP; return NF_DROP;
} }
/* Fall through */ /* Fall through */
case TCP_CONNTRACK_IGNORE: case TCP_CONNTRACK_IGNORE:
...@@ -892,7 +892,7 @@ static int tcp_packet(struct nf_conn *ct, ...@@ -892,7 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: killing out of sync session "); "nf_ct_tcp: killing out of sync session ");
nf_ct_kill(ct); nf_ct_kill(ct);
return -NF_DROP; return NF_DROP;
} }
ct->proto.tcp.last_index = index; ct->proto.tcp.last_index = index;
ct->proto.tcp.last_dir = dir; ct->proto.tcp.last_dir = dir;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment