netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()
This patch fixes a refcount leak of ct objects that may occur if l4proto->error() assigns one conntrack object to one skbuff. In that case, we have to skip further processing in nf_conntrack_in(). With this patch, we can also fix wrong return values (-NF_ACCEPT) for special cases in ICMP[v6] that should not bump the invalid/error statistic counters. Reported-by: Zoltan Menyhart <Zoltan.Menyhart@bull.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
d9be76f385
commit
88ed01d17b
|
@ -160,7 +160,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
|
||||||
/* Update skb to refer to this connection */
|
/* Update skb to refer to this connection */
|
||||||
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
|
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
|
||||||
skb->nfctinfo = *ctinfo;
|
skb->nfctinfo = *ctinfo;
|
||||||
return -NF_ACCEPT;
|
return NF_ACCEPT;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Small and modified version of icmp_rcv */
|
/* Small and modified version of icmp_rcv */
|
||||||
|
|
|
@ -177,7 +177,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
|
||||||
/* Update skb to refer to this connection */
|
/* Update skb to refer to this connection */
|
||||||
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
|
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
|
||||||
skb->nfctinfo = *ctinfo;
|
skb->nfctinfo = *ctinfo;
|
||||||
return -NF_ACCEPT;
|
return NF_ACCEPT;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
|
|
|
@ -922,6 +922,9 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
|
||||||
ret = -ret;
|
ret = -ret;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
/* ICMP[v6] protocol trackers may assign one conntrack. */
|
||||||
|
if (skb->nfct)
|
||||||
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,
|
ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,
|
||||||
|
|
Loading…
Reference in New Issue