diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-09-02 19:37:42 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-27 14:51:09 +0100 |
| commit | 40b90859573f7248686695ce54c4bf8226ce10f7 (patch) | |
| tree | b49883a29fb366725c6b065441a0f9a87438d258 /net/netfilter | |
| parent | e706ece1148f8ba3457578ad1d3a5ed65f4688b0 (diff) | |
| download | linux-stable-40b90859573f7248686695ce54c4bf8226ce10f7.tar.gz linux-stable-40b90859573f7248686695ce54c4bf8226ce10f7.tar.bz2 linux-stable-40b90859573f7248686695ce54c4bf8226ce10f7.zip | |
netfilter: ctnetlink: honor IPS_OFFLOAD flag
[ Upstream commit b067fa009c884401d23846251031c1f14d8a9c77 ]
If this flag is set, timeout and state are irrelevant to userspace.
Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_conntrack_netlink.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 7ba9ea55816a..31fa94064a62 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -555,10 +555,8 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, goto nla_put_failure; if (ctnetlink_dump_status(skb, ct) < 0 || - ctnetlink_dump_timeout(skb, ct) < 0 || ctnetlink_dump_acct(skb, ct, type) < 0 || ctnetlink_dump_timestamp(skb, ct) < 0 || - ctnetlink_dump_protoinfo(skb, ct) < 0 || ctnetlink_dump_helpinfo(skb, ct) < 0 || ctnetlink_dump_mark(skb, ct) < 0 || ctnetlink_dump_secctx(skb, ct) < 0 || @@ -570,6 +568,11 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, ctnetlink_dump_ct_synproxy(skb, ct) < 0) goto nla_put_failure; + if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) && + (ctnetlink_dump_timeout(skb, ct) < 0 || + ctnetlink_dump_protoinfo(skb, ct) < 0)) + goto nla_put_failure; + nlmsg_end(skb, nlh); return skb->len; |