[3.13.y-ckt stable] Patch "netfilter: nf_conntrack: Support expectations in different zones" has been added to staging queue

Kamal Mostafa kamal at canonical.com
Wed Sep 2 00:55:55 UTC 2015


This is a note to let you know that I have just added a patch titled

    netfilter: nf_conntrack: Support expectations in different zones

to the linux-3.13.y-queue branch of the 3.13.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11-ckt26.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 5fa823252bbac01d4c1bdc3d90c8a3b5507b512d Mon Sep 17 00:00:00 2001
From: Joe Stringer <joestringer at nicira.com>
Date: Tue, 21 Jul 2015 21:37:31 -0700
Subject: netfilter: nf_conntrack: Support expectations in different zones

commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream.

When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.

Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: Joe Stringer <joestringer at nicira.com>
Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 net/netfilter/nf_conntrack_expect.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4fd1ca9..71c46f4 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -202,7 +202,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 			a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
 	}

-	return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+	return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+	       nf_ct_zone(a->master) == nf_ct_zone(b->master);
 }

 static inline int expect_matches(const struct nf_conntrack_expect *a,
--
1.9.1





More information about the kernel-team mailing list