diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2024-10-10 13:50:55 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2024-10-10 13:50:55 +0200 |
| commit | 9a3cd877dc93061fbbe0c834d53d89639e7ea46a (patch) | |
| tree | 8e870cb2ad9a9321453c87a3e4cd92d2643a6530 /net/netfilter/xt_connbytes.c | |
| parent | net: do not delay dst_entries_add() in dst_release() (diff) | |
| parent | selftests: netfilter: conntrack_vrf.sh: add fib test case (diff) | |
| download | linux-9a3cd877dc93061fbbe0c834d53d89639e7ea46a.tar.gz linux-9a3cd877dc93061fbbe0c834d53d89639e7ea46a.zip | |
Merge tag 'nf-24-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Restrict xtables extensions to families that are safe, syzbot found
a way to combine ebtables with extensions that are never used by
userspace tools. From Florian Westphal.
2) Set l3mdev inconditionally whenever possible in nft_fib to fix lookup
mismatch, also from Florian.
netfilter pull request 24-10-09
* tag 'nf-24-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
selftests: netfilter: conntrack_vrf.sh: add fib test case
netfilter: fib: check correct rtable in vrf setups
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
====================
Link: https://patch.msgid.link/20241009213858.3565808-1-pablo@netfilter.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/netfilter/xt_connbytes.c')
| -rw-r--r-- | net/netfilter/xt_connbytes.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c index 93cb018c3055..2aabdcea8707 100644 --- a/net/netfilter/xt_connbytes.c +++ b/net/netfilter/xt_connbytes.c @@ -111,9 +111,11 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par) return -EINVAL; ret = nf_ct_netns_get(par->net, par->family); - if (ret < 0) + if (ret < 0) { pr_info_ratelimited("cannot load conntrack support for proto=%u\n", par->family); + return ret; + } /* * This filter cannot function correctly unless connection tracking |