summaryrefslogtreecommitdiffstats
path: root/src/cache-ct.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2013-07-11 00:43:20 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2013-07-11 02:42:55 +0200
commit586382d9a8389ee553db019fd9be14a8a7c0b8ec (patch)
tree5f00a12a32920319c95c5b0acafff0c9957131f5 /src/cache-ct.c
parent479a37a549abf197ce59a4ae1666d8cba80fe977 (diff)
conntrackd: simplify expectation filtering
This patch simplifies the expectation filtering by looking up for the master conntrack. If it does not exists, then we assume that we don't want this expectation either. This simplification also fixes the current broken expectation filtering, since the master conntrack from expectations has neither reply tuple nor state, however, the filtering code assumes the opposite. This partially reverts (479a37a conntrackd: fix crash with IPv6 expectation in the filtering code) since it was incorrectly setting the reply tuple of the master conntrack. Thanks to Bill Fink for providing feedback to resolve this issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/cache-ct.c')
-rw-r--r--src/cache-ct.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/src/cache-ct.c b/src/cache-ct.c
index a538215..f86d143 100644
--- a/src/cache-ct.c
+++ b/src/cache-ct.c
@@ -88,14 +88,21 @@ cache_ct_hash(const void *data, const struct hashtable *table)
return ret;
}
+/* master conntrack of expectations have no ID */
+static inline int
+cache_ct_cmp_id(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
+{
+ return nfct_attr_is_set(ct2, ATTR_ID) ?
+ nfct_get_attr_u32(ct1, ATTR_ID) == nfct_get_attr_u32(ct2, ATTR_ID) : 1;
+}
+
static int cache_ct_cmp(const void *data1, const void *data2)
{
const struct cache_object *obj = data1;
const struct nf_conntrack *ct = data2;
return nfct_cmp(obj->ptr, ct, NFCT_CMP_ORIG) &&
- nfct_get_attr_u32(obj->ptr, ATTR_ID) ==
- nfct_get_attr_u32(ct, ATTR_ID);
+ cache_ct_cmp_id(obj->ptr, ct);
}
static void *cache_ct_alloc(void)