netfilter: nf_conncount: Fix garbage collection with zones

Browse source

Currently, we use check_hlist() for garbage colleciton. However, we
use the ‘zone’ from the counted entry to query the existence of
existing entries in the hlist. This could be wrong when they are in
different zones, and this patch fixes this issue.

Fixes: e59ea3df3f ("netfilter: xt_connlimit: honor conntrack zone if available")
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Yi-Hung Wei 2018-06-12 10:51:34 -07:00 • committed by Pablo Neira Ayuso

parent fc6ddbecce

commit 21ba8847f8

3 changed files with 12 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/net/netfilter/nf_conntrack_count.h

View file

13

net/netfilter/nf_conncount.c

View file

2

net/netfilter/nft_connlimit.c

View file