summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorYi-Hung Wei <yihung.wei@gmail.com>2018-06-12 10:51:34 -0700
committerPablo Neira Ayuso <pablo@netfilter.org>2018-06-12 20:07:07 +0200
commit21ba8847f857028dc83a0f341e16ecc616e34740 (patch)
tree2df27a0099a40362eebd1a1a6be182d52134a550 /include
parentfc6ddbecce440df74fb4491c17c372b52cf5be83 (diff)
netfilter: nf_conncount: Fix garbage collection with zones
Currently, we use check_hlist() for garbage colleciton. However, we use the ‘zone’ from the counted entry to query the existence of existing entries in the hlist. This could be wrong when they are in different zones, and this patch fixes this issue. Fixes: e59ea3df3fc2 ("netfilter: xt_connlimit: honor conntrack zone if available") Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
-rw-r--r--include/net/netfilter/nf_conntrack_count.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/include/net/netfilter/nf_conntrack_count.h b/include/net/netfilter/nf_conntrack_count.h
index 1910b6572430..3a188a0923a3 100644
--- a/include/net/netfilter/nf_conntrack_count.h
+++ b/include/net/netfilter/nf_conntrack_count.h
@@ -20,7 +20,8 @@ unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head,
bool *addit);
bool nf_conncount_add(struct hlist_head *head,
- const struct nf_conntrack_tuple *tuple);
+ const struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_zone *zone);
void nf_conncount_cache_free(struct hlist_head *hhead);