netfilter: nf_conntrack: fix event flooding in GRE protocol tracker
authorFlorian Westphal <fw@strlen.de>
Fri, 30 Sep 2011 14:38:29 +0000 (16:38 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 3 Oct 2011 10:43:24 +0000 (12:43 +0200)
GRE connections cause ctnetlink event flood because the ASSURED event
is set for every packet received.

Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Tested-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_proto_gre.c

index cf616e55ca4193a54c6f949755428649306cfa5f..d69facdd9a7ac527cb947dfd2112b416aa41a19d 100644 (file)
@@ -241,8 +241,8 @@ static int gre_packet(struct nf_conn *ct,
                nf_ct_refresh_acct(ct, ctinfo, skb,
                                   ct->proto.gre.stream_timeout);
                /* Also, more likely to be important, and not a probe. */
-               set_bit(IPS_ASSURED_BIT, &ct->status);
-               nf_conntrack_event_cache(IPCT_ASSURED, ct);
+               if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
+                       nf_conntrack_event_cache(IPCT_ASSURED, ct);
        } else
                nf_ct_refresh_acct(ct, ctinfo, skb,
                                   ct->proto.gre.timeout);