netfilter: conntrack: convert nf_conntrack_update to netfilter verdicts

Browse source

This function calls helpers that can return nf-verdicts, but then
those get converted to -1/0 as thats what the caller expects.

Theoretically NF_DROP could have an errno number set in the upper 24
bits of the return value. Or any of those helpers could return
NF_STOLEN, which would result in use-after-free.

This is fine as-is, the called functions don't do this yet.

But its better to avoid possible future problems if the upcoming
patchset to add NF_DROP_REASON() support gains further users, so remove
the 0/-1 translation from the picture and pass the verdicts down to
the caller.

Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Florian Westphal 2023-10-11 09:59:36 +02:00

parent 4d26ab0086

commit 6291b3a67a

2 changed files with 42 additions and 31 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

58

net/netfilter/nf_conntrack_core.c

View file

15

net/netfilter/nfnetlink_queue.c

View file