Skip to content

Commit

Permalink
netfilter: nf_conntrack: Support expectations in different zones
Browse files Browse the repository at this point in the history
When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.

Fixes: 5d0aa2c (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Joe Stringer authored and Pablo Neira Ayuso committed Jul 22, 2015
1 parent b64f48d commit 4b31814
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion net/netfilter/nf_conntrack_expect.c
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
}

return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
nf_ct_zone(a->master) == nf_ct_zone(b->master);
}

static inline int expect_matches(const struct nf_conntrack_expect *a,
Expand Down

0 comments on commit 4b31814

Please sign in to comment.