7034b566a4
nf_queue handling is broken sincee3b37f11e6("netfilter: replace list_head with single linked list") for two reasons: 1) If the bypass flag is set on, there are no userspace listeners and we still have more hook entries to iterate over, then jump to the next hook. Otherwise accept the packet. On nf_reinject() path, the okfn() needs to be invoked. 2) We should not re-enter the same hook on packet reinjection. If the packet is accepted, we have to skip the current hook from where the packet was enqueued, otherwise the packets gets enqueued over and over again. This restores the previous list_for_each_entry_continue() behaviour happening from nf_iterate() that was dealing with these two cases. This patch introduces a new nf_queue() wrapper function so this fix becomes simpler. Fixes:e3b37f11e6("netfilter: replace list_head with single linked list") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
29 lines
720 B
C
29 lines
720 B
C
#ifndef _NF_INTERNALS_H
|
|
#define _NF_INTERNALS_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/netdevice.h>
|
|
|
|
#ifdef CONFIG_NETFILTER_DEBUG
|
|
#define NFDEBUG(format, args...) printk(KERN_DEBUG format , ## args)
|
|
#else
|
|
#define NFDEBUG(format, args...)
|
|
#endif
|
|
|
|
|
|
/* core.c */
|
|
unsigned int nf_iterate(struct sk_buff *skb, struct nf_hook_state *state,
|
|
struct nf_hook_entry **entryp);
|
|
|
|
/* nf_queue.c */
|
|
int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,
|
|
struct nf_hook_entry **entryp, unsigned int verdict);
|
|
void nf_queue_nf_hook_drop(struct net *net, const struct nf_hook_entry *entry);
|
|
int __init netfilter_queue_init(void);
|
|
|
|
/* nf_log.c */
|
|
int __init netfilter_log_init(void);
|
|
|
|
#endif
|