Skip to main content

Browse the archive

swh:1:snp:38ae39f9fd01a4b0ef06fab5668b65bf4c2aca03
Revision 07998281c268592963e1cd623fe6ab0270b65ae4 authored by Florian Westphal on 05 February 2021, 11:56:43 UTC, committed by Pablo Neira Ayuso on 08 February 2021, 23:04:14 UTC 
netfilter: conntrack: skip identical origin tuple in same zone only
 
The origin skip check needs to re-test the zone. Else, we might skip
a colliding tuple in the reply direction.

This only occurs when using 'directional zones' where origin tuples
reside in different zones but the reply tuples share the same zone.

This causes the new conntrack entry to be dropped at confirmation time
because NAT clash resolution was elided.

Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
1 parent ce7536b
History
Tip revision: 0cdd776ec92c0fec768c7079331804d3e52d4b27 authored by Linus Torvalds on 15 May 2022, 15:08:51 UTC
Merge tag 'driver-core-5.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Tip revision: 0cdd776
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 16.3 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 71 bytes
.gitattributes -rw-r--r-- 62 bytes
.gitignore -rw-r--r-- 1.8 KB
.mailmap -rw-r--r-- 18.0 KB
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 98.4 KB
Kbuild -rw-r--r-- 1.3 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 572.2 KB
Makefile -rw-r--r-- 62.9 KB
README -rw-r--r-- 727 bytes

README

back to top