summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJoe Stringer <joestringer@nicira.com>2015-07-21 21:37:31 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-10-22 14:39:19 -0700
commit918678f0f81f22ee6184b8c3816b8f5f85aaa4da (patch)
treeea014bb8e7d898d431fdbc5af9d96d5ba1e8b281
parent3d9525000f7759de0065bbaf0a4d741bb0d2666d (diff)
netfilter: nf_conntrack: Support expectations in different zones
commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream. When zones were originally introduced, the expectation functions were all extended to perform lookup using the zone. However, insertion was not modified to check the zone. This means that two expectations which are intended to apply for different connections that have the same tuple but exist in different zones cannot both be tracked. Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones") Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/netfilter/nf_conntrack_expect.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4fd1ca94fd4a..71c46f463969 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -202,7 +202,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
}
- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+ nf_ct_zone(a->master) == nf_ct_zone(b->master);
}
static inline int expect_matches(const struct nf_conntrack_expect *a,