diff options
author | Florian Westphal <fw@strlen.de> | 2021-02-05 12:56:43 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-02-09 00:04:14 +0100 |
commit | 07998281c268592963e1cd623fe6ab0270b65ae4 (patch) | |
tree | 1f35dd93ba3f633448b4bff33ca7e6005247f063 /virt | |
parent | ce7536bc7398e2ae552d2fabb7e0e371a9f1fe46 (diff) |
netfilter: conntrack: skip identical origin tuple in same zone only
The origin skip check needs to re-test the zone. Else, we might skip
a colliding tuple in the reply direction.
This only occurs when using 'directional zones' where origin tuples
reside in different zones but the reply tuples share the same zone.
This causes the new conntrack entry to be dropped at confirmation time
because NAT clash resolution was elided.
Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'virt')
0 files changed, 0 insertions, 0 deletions