Skip to contentSkip to conversation

nf_conntrack: re-add missing bits to the TCP conntrack module

PATCH Applied KOVACS Krisztian 2 participants 2 messages Nov 6, 2005 – Nov 12, 2005

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

KOVACS Krisztian

author
#0 lore raw

PATCH 1/1 nf_conntrack: re-add missing bits to the TCP conntrack module

Hi,

I've spent some time playing with nfsim again. With some modifications
of the testsuite I've been finally able to run almost all of the conntrack tests through nf_conntrack. (I've skipped the FTP tests because that needs some more work to compile in nfsim.)

The results: with the attached patch applied all tests succeeded! :)
Unfortunately I was unable to get coverage information due to gcov's lack of support for .so files...

Please review the attached patch and apply if you find it appropriate.

Signature · 2 lines
 Regards,
  Krisztian Kovacs

[NETFILTER] Add missing code to TCP conntrack module

Looks like the nf_conntrack TCP code was slightly mismerged: it does not contain an else branch present in the IPv4 version. Let's add that code and make the testsuite happy.

Signed-off-by KOVACS Krisztian <[email protected]>

---
commit a1499bbf50e4c2807f155a5caa4efd3dadce03a8
tree 803a32e5a682fdaae7ace66685f995189f39d79e
parent 2e4a1678c0318035c131ca36a701f0fd0c9d0cc9
author KOVACS Krisztian <[email protected]> Sun, 06 Nov 2005 21:06:47 +0100 committer KOVACS Krisztian <[email protected]> Sun, 06 Nov 2005 21:06:47 +0100

 net/netfilter/nf_conntrack_proto_tcp.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)
net/netfilter/nf_conntrack_proto_tcp.c +6 -0
index b5ba5d9..c440845 100644
@@ -977,6 +977,12 @@ static int tcp_packet(struct nf_conn *co
 		    		conntrack->timeout.function((unsigned long)
 		    					    conntrack);
 		    	return -NF_REPEAT;
+		} else {
+			write_unlock_bh(&tcp_lock);
+			if (LOG_INVALID(IPPROTO_TCP))
+				nf_log_packet(pf, 0, skb, NULL, NULL,
+					      NULL, "nf_ct_tcp: invalid SYN");
+			return -NF_ACCEPT;
 		}
 	case TCP_CONNTRACK_CLOSE:
 		if (index == TCP_RST_SET
Applied
#1 lore raw
Quoted 1 line · KOVACS Krisztian

Please review the attached patch and apply if you find it appropriate.

thanks, applied.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie