netfilter: conntrack: don't deliver events for racy packets
authorPablo Neira Ayuso <pablo@netfilter.org>
Mon, 16 Mar 2009 14:06:42 +0000 (15:06 +0100)
committerPatrick McHardy <kaber@trash.net>
Mon, 16 Mar 2009 14:06:42 +0000 (15:06 +0100)
This patch skips the delivery of conntrack events if the packet
was drop due to a race condition in the conntrack insertion.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
include/net/netfilter/nf_conntrack_core.h

index c25068e385169b3aee21594df68446696756ad91..5a449b44ba33255f4acebc28879a37ae7e3ab3bd 100644 (file)
@@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
        if (ct && ct != &nf_conntrack_untracked) {
                if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
                        ret = __nf_conntrack_confirm(skb);
-               nf_ct_deliver_cached_events(ct);
+               if (likely(ret == NF_ACCEPT))
+                       nf_ct_deliver_cached_events(ct);
        }
        return ret;
 }