Eric Lee / smarc-fsl-linux-kernel

3
Download as
Browse Code ยป

Commit 07998281c268592963e1cd623fe6ab0270b65ae4

Authored by Florian Westphal
Committed by Pablo Neira Ayuso
1 parent ce7536bc73

netfilter: conntrack: skip identical origin tuple in same zone only 

The origin skip check needs to re-test the zone. Else, we might skip
a colliding tuple in the reply direction.

This only occurs when using 'directional zones' where origin tuples
reside in different zones but the reply tuples share the same zone.

This causes the new conntrack entry to be dropped at confirmation time
because NAT clash resolution was elided.

Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Showing 1 changed file with 2 additions and 1 deletions Side-by-side Diff

net/netfilter/nf_conntrack_core.c
Diff comments   View file @ 0799828
... ... @@ -1229,7 +1229,8 @@
1229 1229 * Let nf_ct_resolve_clash() deal with this later.
1230 1230 */
1231 1231 if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1232   - &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
  1232 + &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
  1233 + nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
1233 1234 continue;
1234 1235  
1235 1236 NF_CT_STAT_INC_ATOMIC(net, found);