* Re: Bug in conntrack -U
2007-06-01 14:17 Bug in conntrack -U Eric Leblond
@ 2007-06-04 9:59 ` Pablo Neira Ayuso
2007-06-04 16:05 ` Eric Leblond
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2007-06-04 9:59 UTC (permalink / raw)
To: Eric Leblond; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 695 bytes --]
Eric Leblond wrote:
> I've found a problem with conntrack-tools. Running :
> conntrack -U -m 20 -s 192.168.50.140 -d 192.168.50.129 -p tcp --orig-port-src 43515 --orig-port-dst 22
> returns
> Operation failed: invalid parameters
>
> Problem has been verified with kernel 2.6.20 and 2.6.17 with subversion
> compiled libraries and conntrack-tools on 32bits and 64bits system. I
> did not find the time to test it on latest kernel.
The problem seems to be in libnetfilter_conntrack. The patch attached
should fix the problem. Thanks for the report.
--
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 730 bytes --]
Index: src/conntrack/build.c
===================================================================
--- src/conntrack/build.c (revisión: 6840)
+++ src/conntrack/build.c (copia de trabajo)
@@ -252,8 +252,13 @@
__build_tuple(req, size, &ct->tuple[__DIR_ORIG], CTA_TUPLE_ORIG);
__build_tuple(req, size, &ct->tuple[__DIR_REPL], CTA_TUPLE_REPLY);
- /* always build IPS_CONFIRMED */
- __build_status(req, size, ct);
+ if (test_bit(ATTR_STATUS, ct->set))
+ __build_status(req, size, ct);
+ else {
+ /* build IPS_CONFIRMED if we're creating a new conntrack */
+ if (type == IPCTNL_MSG_CT_NEW && flags & NLM_F_CREATE)
+ __build_status(req, size, ct);
+ }
if (test_bit(ATTR_TIMEOUT, ct->set))
__build_timeout(req, size, ct);
^ permalink raw reply [flat|nested] 3+ messages in thread