path: root/net/netfilter
diff options
authorJoe Stringer <joestringer@nicira.com>2015-07-21 21:37:31 -0700
committerPablo Neira Ayuso <pablo@netfilter.org>2015-07-22 17:00:47 +0200
commit4b31814d20cbe5cd4ccf18089751e77a04afe4f2 (patch)
treee42ee4d2f3f0353dbd93a6d6a7b11e1771aad883 /net/netfilter
parentb64f48dcda47ac74c890a8e18a62173f62039643 (diff)
netfilter: nf_conntrack: Support expectations in different zones
When zones were originally introduced, the expectation functions were all extended to perform lookup using the zone. However, insertion was not modified to check the zone. This means that two expectations which are intended to apply for different connections that have the same tuple but exist in different zones cannot both be tracked. Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones") Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 7a17070c5dab..b45a4223cb05 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+ nf_ct_zone(a->master) == nf_ct_zone(b->master);
static inline int expect_matches(const struct nf_conntrack_expect *a,

Privacy Policy