path: root/src/run.c
diff options
authorPablo Neira Ayuso <>2008-12-11 18:35:03 +0100
committerPablo Neira Ayuso <>2008-12-11 18:35:03 +0100
commit98154b7d83d1493ba9c2d1b0a8e4b39b635e3082 (patch)
tree896a62636091f87696cbc91bb46f14708273edcd /src/run.c
parentdc544c894eddf90a77d49565673ea7eb216b3e44 (diff)
netlink: fix EILSEQ error messages due to process race condition
This patch fixes a race condition that triggers EILSEQ errors (wrong sequence message). The problems is triggered when the child process resets the timers at the same time that the parent process requests a resync. Since both the child and the parent process use the same descriptors, the sequence tracking code in libnfnetlink gets confused as it considers that it is receiving out of sequence netlink messages. This patch introduces internal handlers to commit and reset timers so that the parent and the child do not use the same descriptors to operate with the kernel. This patch changes the prototype of all nf_*_conntrack() functions. Now, the nfct handler is passed as first parameter, this change is required to fix this problem. The rest of the changes on the API is done for consistency. Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/run.c')
1 files changed, 5 insertions, 5 deletions
diff --git a/src/run.c b/src/run.c
index 8158f10..ee985f4 100644
--- a/src/run.c
+++ b/src/run.c
@@ -111,11 +111,11 @@ void local_handler(int fd, void *data)
switch(type) {
dlog(LOG_NOTICE, "flushing kernel conntrack table");
- nl_flush_conntrack_table();
+ nl_flush_conntrack_table(STATE(request));
dlog(LOG_NOTICE, "resync with master table");
- nl_dump_conntrack_table();
+ nl_dump_conntrack_table(STATE(dump));
@@ -125,7 +125,7 @@ void local_handler(int fd, void *data)
static void do_overrun_alarm(struct alarm_block *a, void *data)
- nl_overrun_request_resync();
+ nl_overrun_request_resync(STATE(overrun));
add_alarm(&STATE(overrun_alarm), 2, 0);
@@ -218,7 +218,7 @@ init(void)
nfct_callback_register(STATE(dump), NFCT_T_ALL, dump_handler, NULL);
- if (nl_dump_conntrack_table() == -1) {
+ if (nl_dump_conntrack_table(STATE(dump)) == -1) {
dlog(LOG_ERR, "can't get kernel conntrack table");
return -1;
@@ -321,7 +321,7 @@ static void __run(struct timeval *next_alarm)
* size and resync with master conntrack table.
- nl_overrun_request_resync();
+ nl_overrun_request_resync(STATE(overrun));
add_alarm(&STATE(overrun_alarm), 2, 0);
case ENOENT: