netfilter: nfnetlink_queue: un-break NF_REPEAT

Browse source

[ Upstream commit f82777e8ce ]

Only override userspace verdict if the ct hook returns something
other than ACCEPT.

Else, this replaces NF_REPEAT (run all hooks again) with NF_ACCEPT
(move to next hook).

Fixes: 6291b3a67a ("netfilter: conntrack: convert nf_conntrack_update to netfilter verdicts")
Reported-by: l.6diay@passmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Florian Westphal 2024-02-06 17:54:18 +01:00 • committed by Greg Kroah-Hartman

parent 383182db8d

commit 3c0c0cf930

1 changed files with 10 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

13

net/netfilter/nfnetlink_queue.c

View file