diff options
| -rw-r--r-- | net/netfilter/xt_socket.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 030f33cd9..f4080c48e 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -107,7 +107,7 @@ xt_socket_get4_sk(const struct sk_buff *skb, struct xt_action_param *par) { const struct iphdr *iph = ip_hdr(skb); struct udphdr _hdr, *hp = NULL; - struct sock *sk; + struct sock *sk = skb->sk; __be32 uninitialized_var(daddr), uninitialized_var(saddr); __be16 uninitialized_var(dport), uninitialized_var(sport); u8 uninitialized_var(protocol); @@ -156,7 +156,8 @@ xt_socket_get4_sk(const struct sk_buff *skb, struct xt_action_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); + saddr, daddr, sport, dport, + par->in, NFT_LOOKUP_ANY); pr_debug("proto %hhu %pI4:%hu -> %pI4:%hu (orig %pI4:%hu) sock %p\n", protocol, &saddr, ntohs(sport), @@ -174,7 +175,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, struct sock *sk; sk = xt_socket_get4_sk(skb, par); - if (sk != NULL) { + if (sk) { bool wildcard; bool transparent = true; @@ -190,7 +191,8 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, (sk->sk_state == TCP_TIME_WAIT && inet_twsk(sk)->tw_transparent)); - xt_socket_put_sk(sk); + if (sk != skb->sk) + xt_socket_put_sk(sk); if (wildcard || !transparent) sk = NULL; @@ -272,7 +274,7 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par) { struct ipv6hdr *iph = ipv6_hdr(skb); struct udphdr _hdr, *hp = NULL; - struct sock *sk; + struct sock *sk = skb->sk; struct in6_addr *daddr = NULL, *saddr = NULL; __be16 uninitialized_var(dport), uninitialized_var(sport); int thoff = 0, uninitialized_var(tproto); @@ -303,7 +305,9 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par) } sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, - saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); + saddr, daddr, sport, dport, + par->in, NFT_LOOKUP_ANY); + pr_debug("proto %hhd %pI6:%hu -> %pI6:%hu " "(orig %pI6:%hu) sock %p\n", tproto, saddr, ntohs(sport), @@ -321,7 +325,8 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) info = (struct xt_socket_mtinfo1 *) par->matchinfo; sk = xt_socket_get6_sk(skb, par); - if (sk != NULL) { + + if (sk) { bool wildcard; bool transparent = true; @@ -337,7 +342,8 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) (sk->sk_state == TCP_TIME_WAIT && inet_twsk(sk)->tw_transparent)); - xt_socket_put_sk(sk); + if (sk != skb->sk) + xt_socket_put_sk(sk); if (wildcard || !transparent) sk = NULL; |