[PATCH] Iterate lists from the tail to the head

[PATCH] Iterate lists from the tail to the head

[Pablo Neira]

[-- Attachment #1: Type: text/plain, Size: 893 bytes --]

Currently conntracks are inserted after the head. That means that 
conntracks are sorted from the biggest to the smallest id. This happens 
because we use list_prepend (list_add) instead list_add_tail. This can 
result in problems during the list iteration.

                 list_for_each(i, &ip_conntrack_hash[cb->args[0]]) {
                         h = (struct ip_conntrack_tuple_hash *) i;
                         if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                 continue;
                         ct = tuplehash_to_ctrack(h);
                         if (ct->id <= *id)
                                 continue;

In that case just the first conntrack in the bucket will be dumped. To 
fix this, we iterate the list from the tail to the head via 
list_for_each_prev. Same thing for the list of expectations.

Signed-off-by: Pablo Neira Ayuso <pablo@eurodev.net>

[-- Attachment #2: 02list-prev.patch --]
[-- Type: text/x-patch, Size: 1344 bytes --]

Index: netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
--- netfilter-2.6.14.orig/net/ipv4/netfilter/ip_conntrack_netlink.c	2005-08-03 14:48:04.000000000 +0200
+++ netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_netlink.c	2005-08-04 15:24:26.000000000 +0200
@@ -404,7 +404,7 @@
 
 	read_lock_bh(&ip_conntrack_lock);
 	for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++, *id = 0) {
-		list_for_each(i, &ip_conntrack_hash[cb->args[0]]) {
+		list_for_each_prev(i, &ip_conntrack_hash[cb->args[0]]) {
 			h = (struct ip_conntrack_tuple_hash *) i;
 			if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
 				continue;
@@ -441,7 +441,7 @@
 
 	write_lock_bh(&ip_conntrack_lock);
 	for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++, *id = 0) {
-		list_for_each(i, &ip_conntrack_hash[cb->args[0]]) {
+		list_for_each_prev(i, &ip_conntrack_hash[cb->args[0]]) {
 			h = (struct ip_conntrack_tuple_hash *) i;
 			if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
 				continue;
@@ -1214,7 +1214,7 @@
 	DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
 
 	read_lock_bh(&ip_conntrack_lock);
-	list_for_each(i, &ip_conntrack_expect_list) {
+	list_for_each_prev(i, &ip_conntrack_expect_list) {
 		exp = (struct ip_conntrack_expect *) i;
 		if (exp->id <= *id)
 			continue;

Re: [PATCH] Iterate lists from the tail to the head

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 723 bytes --]

On Fri, Aug 05, 2005 at 02:36:58AM +0200, Pablo Neira wrote:
> Currently conntracks are inserted after the head. That means that conntracks 
> are sorted from the biggest to the smallest id. This happens because we use 
> list_prepend (list_add) instead list_add_tail. This can result in problems 
> during the list iteration.

thanks, applied.
-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]