Skip to content

Commit

Permalink
netfilter: ctnetlink: reject new conntrack request with different l4p…
Browse files Browse the repository at this point in the history
…roto

Currently, user can add a conntrack with different l4proto via nfnetlink.
For example, original tuple is TCP while reply tuple is SCTP. This is
invalid combination, we should report EINVAL to userspace.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Liping Zhang authored and Pablo Neira Ayuso committed Aug 9, 2016
1 parent 00a3101 commit aa0c2c6
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions net/netfilter/nf_conntrack_netlink.c
Original file line number Diff line number Diff line change
Expand Up @@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,

if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
return -EINVAL;
if (otuple.dst.protonum != rtuple.dst.protonum)
return -EINVAL;

ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
&rtuple, u3);
Expand Down

0 comments on commit aa0c2c6

Please sign in to comment.