Commit 07b5a76e authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: avoid misleading 'invalid' in log message 



The packet is not flagged as invalid: conntrack will accept it and
its associated with the conntrack entry.

This happens e.g. when receiving a retransmitted SYN in SYN_RECV state.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 03a3ca37

net/netfilter/nf_conntrack_proto_tcp.c

+4 −2
Original line number Diff line number Diff line
@@ -982,8 +982,10 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
					IP_CT_EXP_CHALLENGE_ACK;

		}

		spin_unlock_bh(&ct->lock);

		nf_ct_l4proto_log_invalid(skb, ct, "invalid packet ignored in "

					  "state %s ", tcp_conntrack_names[old_state]);

		nf_ct_l4proto_log_invalid(skb, ct,

					  "packet (index %d) in dir %d ignored, state %s",

					  index, dir,

					  tcp_conntrack_names[old_state]);

		return NF_ACCEPT;

	case TCP_CONNTRACK_MAX:

		/* Special case for SYN proxy: when the SYN to the server or