[NETFILTER]: fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK
Fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK When xt_CONNMARK is used outside the mangle table and the user specified "--restore-mark", the connmark_tg_check() function will (correctly) error out, but (incorrectly) forgets to release the L3 conntrack module. Same for xt_CONNSECMARK. Fix is to move the call to acquire the L3 module after the basic constraint checks. Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
9dc0564e86
commit
67b4af2970
2 changed files with 10 additions and 10 deletions
|
@ -86,11 +86,6 @@ checkentry(const char *tablename,
|
||||||
{
|
{
|
||||||
const struct xt_connmark_target_info *matchinfo = targinfo;
|
const struct xt_connmark_target_info *matchinfo = targinfo;
|
||||||
|
|
||||||
if (nf_ct_l3proto_try_module_get(target->family) < 0) {
|
|
||||||
printk(KERN_WARNING "can't load conntrack support for "
|
|
||||||
"proto=%d\n", target->family);
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
if (matchinfo->mode == XT_CONNMARK_RESTORE) {
|
if (matchinfo->mode == XT_CONNMARK_RESTORE) {
|
||||||
if (strcmp(tablename, "mangle") != 0) {
|
if (strcmp(tablename, "mangle") != 0) {
|
||||||
printk(KERN_WARNING "CONNMARK: restore can only be "
|
printk(KERN_WARNING "CONNMARK: restore can only be "
|
||||||
|
@ -103,6 +98,11 @@ checkentry(const char *tablename,
|
||||||
printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
|
printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
if (nf_ct_l3proto_try_module_get(target->family) < 0) {
|
||||||
|
printk(KERN_WARNING "can't load conntrack support for "
|
||||||
|
"proto=%d\n", target->family);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -90,11 +90,6 @@ static bool checkentry(const char *tablename, const void *entry,
|
||||||
{
|
{
|
||||||
const struct xt_connsecmark_target_info *info = targinfo;
|
const struct xt_connsecmark_target_info *info = targinfo;
|
||||||
|
|
||||||
if (nf_ct_l3proto_try_module_get(target->family) < 0) {
|
|
||||||
printk(KERN_WARNING "can't load conntrack support for "
|
|
||||||
"proto=%d\n", target->family);
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
switch (info->mode) {
|
switch (info->mode) {
|
||||||
case CONNSECMARK_SAVE:
|
case CONNSECMARK_SAVE:
|
||||||
case CONNSECMARK_RESTORE:
|
case CONNSECMARK_RESTORE:
|
||||||
|
@ -105,6 +100,11 @@ static bool checkentry(const char *tablename, const void *entry,
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (nf_ct_l3proto_try_module_get(target->family) < 0) {
|
||||||
|
printk(KERN_WARNING "can't load conntrack support for "
|
||||||
|
"proto=%d\n", target->family);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue