From 4acdbdbe5089c06d5e0c7e96783fcc4414ded00a Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Thu, 21 Jul 2005 13:14:46 -0700 Subject: [NETFILTER]: ip_conntrack_expect_related must not free expectation If a connection tracking helper tells us to expect a connection, and we're already expecting that connection, we simply free the one they gave us and return success. The problem is that NAT helpers (eg. FTP) have to allocate the expectation first (to see what port is available) then rewrite the packet. If that rewrite fails, they try to remove the expectation, but it was freed in ip_conntrack_expect_related. This is one example of a larger problem: having registered the expectation, the pointer is no longer ours to use. Reference counting is needed for ctnetlink anyway, so introduce it now. To have a single "put" path, we need to grab the reference to the connection on creation, rather than open-coding it in the caller. Signed-off-by: Rusty Russell Signed-off-by: David S. Miller --- include/linux/netfilter_ipv4/ip_conntrack.h | 3 +++ include/linux/netfilter_ipv4/ip_conntrack_helper.h | 7 ++++--- 2 files changed, 7 insertions(+), 3 deletions(-) (limited to 'include/linux') diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h index 3781192ce15..f8da7ddeff3 100644 --- a/include/linux/netfilter_ipv4/ip_conntrack.h +++ b/include/linux/netfilter_ipv4/ip_conntrack.h @@ -197,6 +197,9 @@ struct ip_conntrack_expect /* Timer function; deletes the expectation. */ struct timer_list timeout; + /* Usage count. */ + atomic_t use; + #ifdef CONFIG_IP_NF_NAT_NEEDED /* This is the original per-proto part, used to map the * expected connection the way the recipient expects. */ diff --git a/include/linux/netfilter_ipv4/ip_conntrack_helper.h b/include/linux/netfilter_ipv4/ip_conntrack_helper.h index b1bbba0a12c..3692daa93de 100644 --- a/include/linux/netfilter_ipv4/ip_conntrack_helper.h +++ b/include/linux/netfilter_ipv4/ip_conntrack_helper.h @@ -30,9 +30,10 @@ extern int ip_conntrack_helper_register(struct ip_conntrack_helper *); extern void ip_conntrack_helper_unregister(struct ip_conntrack_helper *); /* Allocate space for an expectation: this is mandatory before calling - ip_conntrack_expect_related. */ -extern struct ip_conntrack_expect *ip_conntrack_expect_alloc(void); -extern void ip_conntrack_expect_free(struct ip_conntrack_expect *exp); + ip_conntrack_expect_related. You will have to call put afterwards. */ +extern struct ip_conntrack_expect * +ip_conntrack_expect_alloc(struct ip_conntrack *master); +extern void ip_conntrack_expect_put(struct ip_conntrack_expect *exp); /* Add an expected connection: can have more than one per connection */ extern int ip_conntrack_expect_related(struct ip_conntrack_expect *exp); -- cgit v1.2.3-70-g09d2