[NETFILTER]: H.323 helper: avoid long expectation chains The RAS helper can exect new RAS connections when Gatekeeper discovery is performed. This could lead to a situation where there is a long chain of master conntracks which is recursively freed by destroy_conntrack or which consumes lots of memory with only a single hashed conntrack, decreasing chances of beeing evicted under memory pressure. Avoid creating RAS expectations for already expected connections. Signed-off-by: Patrick McHardy --- commit 74dc9a728dc33fab70b73ee30aca44bd2a0259ec tree 6d3d7b250377b8587c9e32236ac22d91f4fb3300 parent 134aa8950c66de37bd644e7826c4d5cb1f1535ab author Patrick McHardy Thu, 23 Feb 2006 20:22:10 +0100 committer Patrick McHardy Thu, 23 Feb 2006 20:22:10 +0100 net/ipv4/netfilter/ip_conntrack_helper_h323.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c index 5692b2f..fa6e73f 100644 --- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c +++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c @@ -1091,6 +1091,10 @@ static int process_gcf(struct sk_buff ** port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port)) return 0; + /* Avoid RAS expectation loops. A GCF is never expected. */ + if (test_bit(IPS_EXPECTED_BIT, &ct->status)) + return 0; + /* Need new expect */ if ((exp = ip_conntrack_expect_alloc(ct)) == NULL) return -1;