lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 16 Mar 2009 17:08:43 +0100 (MET) From: Patrick McHardy <kaber@...sh.net> To: davem@...emloft.net Cc: netdev@...r.kernel.org, Patrick McHardy <kaber@...sh.net>, netfilter-devel@...r.kernel.org Subject: netfilter 01/04: conntrack: don't deliver events for racy packets commit b1e93a68ca41e7e73766f95ba32ca05cf9052e15 Author: Pablo Neira Ayuso <pablo@...filter.org> Date: Mon Mar 16 15:06:42 2009 +0100 netfilter: conntrack: don't deliver events for racy packets This patch skips the delivery of conntrack events if the packet was drop due to a race condition in the conntrack insertion. Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org> Signed-off-by: Patrick McHardy <kaber@...sh.net> diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index c25068e..5a449b4 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb) if (ct && ct != &nf_conntrack_untracked) { if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) ret = __nf_conntrack_confirm(skb); - nf_ct_deliver_cached_events(ct); + if (likely(ret == NF_ACCEPT)) + nf_ct_deliver_cached_events(ct); } return ret; } -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists