Commit 4b31814d authored by Joe Stringer's avatar Joe Stringer Committed by Pablo Neira Ayuso

netfilter: nf_conntrack: Support expectations in different zones

When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.

Fixes: 5d0aa2cc (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: default avatarJoe Stringer <joestringer@nicira.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b64f48dc
...@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a, ...@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
} }
return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask); return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
nf_ct_zone(a->master) == nf_ct_zone(b->master);
} }
static inline int expect_matches(const struct nf_conntrack_expect *a, static inline int expect_matches(const struct nf_conntrack_expect *a,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment