redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

netfilter: ctnetlink: Fix regression in CTA_HELP processing 

Prior to Linux 4.4, it was usually harmless to send a CTA_HELP attribute
containing the name of the current helper.  That is no longer the case:
as of Linux 4.4, if ctnetlink_change_helper() returns an error from
the ct->master check, processing of the request will fail, skipping the
NFQA_EXP attribute (if present).

This patch changes the behavior to improve compatibility with user
programs that expect the kernel interface to work the way it did prior
to Linux 4.4.  If a user program specifies CTA_HELP but the argument
matches the current conntrack helper name, ignore it instead of generating
an error.

Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
hifive-unleashed-5.1
Kevin Cernekee 2017-01-26 14:49:44 -08:00 committed by Pablo Neira Ayuso
parent a963d710f3
commit f95d7a46bc
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
net/netfilter/nf_conntrack_netlink.c
View File

@ -1478,14 +1478,23 @@ static int ctnetlink_change_helper(struct nf_conn *ct,
struct nlattr *helpinfo = NULL;
int err;
/* don't change helper of sibling connections */
if (ct->master)
return -EBUSY;
err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
if (err < 0)
return err;
/* don't change helper of sibling connections */
if (ct->master) {
/* If we try to change the helper to the same thing twice,
* treat the second attempt as a no-op instead of returning
* an error.
*/
if (help && help->helper &&
!strcmp(help->helper->name, helpname))
return 0;
else
return -EBUSY;
}
if (!strcmp(helpname, "")) {
if (help && help->helper) {
/* we had a helper before ... */