Commit d63a9281 authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller

[NETFILTER]: stop tracking ICMP error at early point

Currently connection tracking handles ICMP error like normal packets
if it failed to get related connection. But it fails that after all.

This makes connection tracking stop tracking ICMP error at early point.
Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarHarald Welte <laforge@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ed77de9f
...@@ -151,13 +151,13 @@ icmp_error_message(struct sk_buff *skb, ...@@ -151,13 +151,13 @@ icmp_error_message(struct sk_buff *skb,
/* Not enough header? */ /* Not enough header? */
inside = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_in), &_in); inside = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_in), &_in);
if (inside == NULL) if (inside == NULL)
return NF_ACCEPT; return -NF_ACCEPT;
/* Ignore ICMP's containing fragments (shouldn't happen) */ /* Ignore ICMP's containing fragments (shouldn't happen) */
if (inside->ip.frag_off & htons(IP_OFFSET)) { if (inside->ip.frag_off & htons(IP_OFFSET)) {
DEBUGP("icmp_error_track: fragment of proto %u\n", DEBUGP("icmp_error_track: fragment of proto %u\n",
inside->ip.protocol); inside->ip.protocol);
return NF_ACCEPT; return -NF_ACCEPT;
} }
innerproto = ip_conntrack_proto_find_get(inside->ip.protocol); innerproto = ip_conntrack_proto_find_get(inside->ip.protocol);
...@@ -166,7 +166,7 @@ icmp_error_message(struct sk_buff *skb, ...@@ -166,7 +166,7 @@ icmp_error_message(struct sk_buff *skb,
if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) { if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) {
DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol); DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol);
ip_conntrack_proto_put(innerproto); ip_conntrack_proto_put(innerproto);
return NF_ACCEPT; return -NF_ACCEPT;
} }
/* Ordinarily, we'd expect the inverted tupleproto, but it's /* Ordinarily, we'd expect the inverted tupleproto, but it's
...@@ -174,7 +174,7 @@ icmp_error_message(struct sk_buff *skb, ...@@ -174,7 +174,7 @@ icmp_error_message(struct sk_buff *skb,
if (!ip_ct_invert_tuple(&innertuple, &origtuple, innerproto)) { if (!ip_ct_invert_tuple(&innertuple, &origtuple, innerproto)) {
DEBUGP("icmp_error_track: Can't invert tuple\n"); DEBUGP("icmp_error_track: Can't invert tuple\n");
ip_conntrack_proto_put(innerproto); ip_conntrack_proto_put(innerproto);
return NF_ACCEPT; return -NF_ACCEPT;
} }
ip_conntrack_proto_put(innerproto); ip_conntrack_proto_put(innerproto);
...@@ -190,7 +190,7 @@ icmp_error_message(struct sk_buff *skb, ...@@ -190,7 +190,7 @@ icmp_error_message(struct sk_buff *skb,
if (!h) { if (!h) {
DEBUGP("icmp_error_track: no match\n"); DEBUGP("icmp_error_track: no match\n");
return NF_ACCEPT; return -NF_ACCEPT;
} }
/* Reverse direction from that found */ /* Reverse direction from that found */
if (DIRECTION(h) != IP_CT_DIR_REPLY) if (DIRECTION(h) != IP_CT_DIR_REPLY)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment