diff options
author | Rusty Russell <rusty@rustcorp.com.au> | 2005-07-21 13:14:46 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2005-07-21 13:14:46 -0700 |
commit | 4acdbdbe5089c06d5e0c7e96783fcc4414ded00a (patch) | |
tree | 77629aef70bd92983518b6f5dd13c70a222c4cbb /net/ipv4/netfilter/ip_conntrack_tftp.c | |
parent | 4aa49d130df9209707a97786a55a3f584b7345e9 (diff) | |
download | linux-3.10-4acdbdbe5089c06d5e0c7e96783fcc4414ded00a.tar.gz linux-3.10-4acdbdbe5089c06d5e0c7e96783fcc4414ded00a.tar.bz2 linux-3.10-4acdbdbe5089c06d5e0c7e96783fcc4414ded00a.zip |
[NETFILTER]: ip_conntrack_expect_related must not free expectation
If a connection tracking helper tells us to expect a connection, and
we're already expecting that connection, we simply free the one they
gave us and return success.
The problem is that NAT helpers (eg. FTP) have to allocate the
expectation first (to see what port is available) then rewrite the
packet. If that rewrite fails, they try to remove the expectation,
but it was freed in ip_conntrack_expect_related.
This is one example of a larger problem: having registered the
expectation, the pointer is no longer ours to use. Reference counting
is needed for ctnetlink anyway, so introduce it now.
To have a single "put" path, we need to grab the reference to the
connection on creation, rather than open-coding it in the caller.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/ip_conntrack_tftp.c')
-rw-r--r-- | net/ipv4/netfilter/ip_conntrack_tftp.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c index 992fac3e36e..f8ff170f390 100644 --- a/net/ipv4/netfilter/ip_conntrack_tftp.c +++ b/net/ipv4/netfilter/ip_conntrack_tftp.c @@ -65,7 +65,7 @@ static int tftp_help(struct sk_buff **pskb, DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); - exp = ip_conntrack_expect_alloc(); + exp = ip_conntrack_expect_alloc(ct); if (exp == NULL) return NF_DROP; @@ -75,17 +75,15 @@ static int tftp_help(struct sk_buff **pskb, exp->mask.dst.u.udp.port = 0xffff; exp->mask.dst.protonum = 0xff; exp->expectfn = NULL; - exp->master = ct; DEBUGP("expect: "); DUMP_TUPLE(&exp->tuple); DUMP_TUPLE(&exp->mask); if (ip_nat_tftp_hook) ret = ip_nat_tftp_hook(pskb, ctinfo, exp); - else if (ip_conntrack_expect_related(exp) != 0) { - ip_conntrack_expect_free(exp); + else if (ip_conntrack_expect_related(exp) != 0) ret = NF_DROP; - } + ip_conntrack_expect_put(exp); break; case TFTP_OPCODE_DATA: case TFTP_OPCODE_ACK: |