netfilter: ctnetlink: Fix regression in CTA_HELP processing
authorKevin Cernekee <cernekee@chromium.org>
Thu, 26 Jan 2017 22:49:44 +0000 (14:49 -0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 6 Feb 2017 11:49:05 +0000 (12:49 +0100)
commitf95d7a46bc5722767c30ee223c8b67dd0f2e8793
treec22899b99bfdf4d9bbe7eabc33ba013f7dea79a9
parenta963d710f367f68cd13d562a07db55ccb8daade9
netfilter: ctnetlink: Fix regression in CTA_HELP processing

Prior to Linux 4.4, it was usually harmless to send a CTA_HELP attribute
containing the name of the current helper.  That is no longer the case:
as of Linux 4.4, if ctnetlink_change_helper() returns an error from
the ct->master check, processing of the request will fail, skipping the
NFQA_EXP attribute (if present).

This patch changes the behavior to improve compatibility with user
programs that expect the kernel interface to work the way it did prior
to Linux 4.4.  If a user program specifies CTA_HELP but the argument
matches the current conntrack helper name, ignore it instead of generating
an error.

Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_netlink.c