lkml.org 
[lkml]   [2015]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 029/130] netfilter: nf_conntrack: Support expectations in different zones
    Date
    3.16.7-ckt17 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Joe Stringer <joestringer@nicira.com>

    commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream.

    When zones were originally introduced, the expectation functions were
    all extended to perform lookup using the zone. However, insertion was
    not modified to check the zone. This means that two expectations which
    are intended to apply for different connections that have the same tuple
    but exist in different zones cannot both be tracked.

    Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones")
    Signed-off-by: Joe Stringer <joestringer@nicira.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    net/netfilter/nf_conntrack_expect.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
    index f87e8f68ad45..c45186f91cc8 100644
    --- a/net/netfilter/nf_conntrack_expect.c
    +++ b/net/netfilter/nf_conntrack_expect.c
    @@ -218,7 +218,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
    a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
    }

    - return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
    + return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
    + nf_ct_zone(a->master) == nf_ct_zone(b->master);
    }

    static inline int expect_matches(const struct nf_conntrack_expect *a,

    \
     
     \ /
      Last update: 2015-09-04 16:21    [W:4.535 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site