Skip to contentSkip to conversation

fix ipt_conntrack leftover

PATCH Applied Pablo Neira 2 participants 2 messages Apr 8, 2005 – Apr 10, 2005 netfilter

lore
Share & tools
lore

Pablo Neira

author
#0 lore raw

PATCH 1/1 fix ipt_conntrack leftover

This patch is for iptables.

someone forgot to update ipt_conntrack.h header in user space. So, update it to use ip_conntrack_old_tuple.

--
Pablo

linux/netfilter_ipv4/ipt_conntrack.h +22 -1
Index: include/linux/netfilter_ipv4/ipt_conntrack.h
===================================================================
@@ -22,11 +22,32 @@
 #define IPT_CONNTRACK_STATUS	0x40
 #define IPT_CONNTRACK_EXPIRES	0x80
 
+/* This is exposed to userspace, so remains frozen in time. */
+struct ip_conntrack_old_tuple
+{
+	struct {
+		u_int32_t ip;
+		union {
+			u_int16_t all;
+		} u;
+	} src;
+
+	struct {
+		u_int32_t ip;
+		union {
+			u_int16_t all;
+		} u;
+
+		/* The protocol. */
+		u_int16_t protonum;
+	} dst;
+};
+
 struct ipt_conntrack_info
 {
 	unsigned int statemask, statusmask;
 
-	struct ip_conntrack_tuple tuple[IP_CT_DIR_MAX];
+	struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX];
 	struct in_addr sipmsk[IP_CT_DIR_MAX], dipmsk[IP_CT_DIR_MAX];
 
 #ifdef KERNEL_64_USERSPACE_32
Applied
#1 lore raw
Quoted 4 lines · Pablo Neira

This patch is for iptables.

someone forgot to update ipt_conntrack.h header in user space. So, update it to use ip_conntrack_old_tuple.

thanks, applied.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie