diff options
| author | Jason Xing <kernelxing@tencent.com> | 2024-03-25 10:59:38 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-05-06 11:13:56 +0200 |
| commit | 40616789ec462df0e97ee1d5aa4e4fed4249cae0 (patch) | |
| tree | 0a47b2ff880ae96508202dc1a1a7196c17d4d1e9 /net/netfilter | |
| parent | 4a3540a8bf3c13dc3955f0c0895332b9c653be3f (diff) | |
| download | linux-40616789ec462df0e97ee1d5aa4e4fed4249cae0.tar.gz linux-40616789ec462df0e97ee1d5aa4e4fed4249cae0.tar.bz2 linux-40616789ec462df0e97ee1d5aa4e4fed4249cae0.zip | |
netfilter: conntrack: dccp: try not to drop skb in conntrack
It would be better not to drop skb in conntrack unless we have good
alternatives. So we can treat the result of testing skb's header
pointer as nf_conntrack_tcp_packet() does.
Signed-off-by: Jason Xing <kernelxing@tencent.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_conntrack_proto_dccp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c index e2db1f4ec2df..ebc4f733bb2e 100644 --- a/net/netfilter/nf_conntrack_proto_dccp.c +++ b/net/netfilter/nf_conntrack_proto_dccp.c @@ -525,7 +525,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); if (!dh) - return NF_DROP; + return -NF_ACCEPT; if (dccp_error(dh, skb, dataoff, state)) return -NF_ACCEPT; @@ -533,7 +533,7 @@ int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, /* pull again, including possible 48 bit sequences and subtype header */ dh = dccp_header_pointer(skb, dataoff, dh, &_dh); if (!dh) - return NF_DROP; + return -NF_ACCEPT; type = dh->dccph_type; if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state)) |