mirror of
https://github.com/Fishwaldo/linux-bl808.git
synced 2025-06-11 00:57:47 +00:00
netfilter: ctnetlink: reject new conntrack request with different l4proto
Currently, user can add a conntrack with different l4proto via nfnetlink. For example, original tuple is TCP while reply tuple is SCTP. This is invalid combination, we should report EINVAL to userspace. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
00a3101f56
commit
aa0c2c68ab
1 changed files with 2 additions and 0 deletions
|
@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
|
||||||
|
|
||||||
if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
|
if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
if (otuple.dst.protonum != rtuple.dst.protonum)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
|
ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
|
||||||
&rtuple, u3);
|
&rtuple, u3);
|
||||||
|
|
Loading…
Add table
Reference in a new issue