Currently, user can add a conntrack with different l4proto via nfnetlink. For example, original tuple is TCP while reply tuple is SCTP. This is invalid combination, we should report EINVAL to userspace.
Unified · Split
| @@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl, · 1893 unmodified lines | ||
| 1894 | 1894 | |
| 1895 | 1895 | if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY]) |
| 1896 | 1896 | return -EINVAL; |
| 1897 | + if (otuple.dst.protonum != rtuple.dst.protonum) | |
| 1898 | + return -EINVAL; | |
| 1897 | 1899 | |
| 1898 | 1900 | ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple, |
| 1899 | 1901 | &rtuple, u3); |