diff options
| author | Michal 'vorner' Vaner <michal.vaner@avast.com> | 2018-09-04 13:25:44 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-11 01:31:47 +0200 |
| commit | ad18d7bf68a3da860ebb62a59c449804a6d237b4 (patch) | |
| tree | a8a3030326651c8b1fbd17a78d0f777247437eb7 /net | |
| parent | netfilter: cttimeout: ctnl_timeout_find_get() returns incorrect pointer to type (diff) | |
| download | linux-ad18d7bf68a3da860ebb62a59c449804a6d237b4.tar.xz linux-ad18d7bf68a3da860ebb62a59c449804a6d237b4.zip | |
netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT
NF_REPEAT places the packet at the beginning of the iptables chain
instead of accepting or rejecting it right away. The packet however will
reach the end of the chain and continue to the end of iptables
eventually, so it needs the same handling as NF_ACCEPT and NF_DROP.
Fixes: 368982cd7d1b ("netfilter: nfnetlink_queue: resolve clash for unconfirmed conntracks")
Signed-off-by: Michal 'vorner' Vaner <michal.vaner@avast.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nfnetlink_queue.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index ea4ba551abb2..d33094f4ec41 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -233,6 +233,7 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) int err; if (verdict == NF_ACCEPT || + verdict == NF_REPEAT || verdict == NF_STOP) { rcu_read_lock(); ct_hook = rcu_dereference(nf_ct_hook); |