Skip to content

Commit

Permalink
netfilter: xt_conntrack: fix inverted conntrack direction test
Browse files Browse the repository at this point in the history
--ctdir ORIGINAL matches REPLY packets, and vv:

userspace sets "invert_flags &= ~XT_CONNTRACK_DIRECTION" in ORIGINAL
case.

Thus: (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
      !!(info->invert_flags & XT_CONNTRACK_DIRECTION))

yields "1 ^ 0", which is true -> returns false.

Reproducer:
iptables -I OUTPUT 1 -p tcp --syn -m conntrack --ctdir ORIGINAL

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
  • Loading branch information
Florian Westphal authored and Patrick McHardy committed Apr 4, 2011
1 parent b722504 commit 96120d8
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/netfilter/xt_conntrack.c
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
return info->match_flags & XT_CONNTRACK_STATE;
if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
!!(info->invert_flags & XT_CONNTRACK_DIRECTION))
!(info->invert_flags & XT_CONNTRACK_DIRECTION))
return false;

if (info->match_flags & XT_CONNTRACK_ORIGSRC)
Expand Down

0 comments on commit 96120d8

Please sign in to comment.