Commit f4de4c89 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso

netfilter: synproxy_core: fix warning in __nf_ct_ext_add_length()

With CONFIG_NETFILTER_DEBUG we get the following warning during SYNPROXY init:

[   80.558906] WARNING: CPU: 1 PID: 4833 at net/netfilter/nf_conntrack_extend.c:80 __nf_ct_ext_add_length+0x217/0x220 [nf_conntrack]()

The reason is that the conntrack template is set to confirmed before adding
the extension and it is invalid to add extensions to already confirmed
conntracks. Fix by adding the extensions before setting the conntrack to
confirmed.
Reported-by: default avatarJesper Dangaard Brouer <jesper.brouer@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 775ada6d
...@@ -356,12 +356,12 @@ static int __net_init synproxy_net_init(struct net *net) ...@@ -356,12 +356,12 @@ static int __net_init synproxy_net_init(struct net *net)
goto err1; goto err1;
} }
__set_bit(IPS_TEMPLATE_BIT, &ct->status);
__set_bit(IPS_CONFIRMED_BIT, &ct->status);
if (!nfct_seqadj_ext_add(ct)) if (!nfct_seqadj_ext_add(ct))
goto err2; goto err2;
if (!nfct_synproxy_ext_add(ct)) if (!nfct_synproxy_ext_add(ct))
goto err2; goto err2;
__set_bit(IPS_TEMPLATE_BIT, &ct->status);
__set_bit(IPS_CONFIRMED_BIT, &ct->status);
snet->tmpl = ct; snet->tmpl = ct;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment