netfilter: ctnetlink: fix filtering for zone 0
previously filtering for the default zone would actually skip the zone
filter and flush all zones.
Fixes: eff3c558bb
("netfilter: ctnetlink: support filtering by zone")
Reported-by: Ilya Maximets <i.maximets@ovn.org>
Closes: https://lore.kernel.org/netdev/2032238f-31ac-4106-8f22-522e76df5a12@ovn.org/
Signed-off-by: Felix Huettner <felix.huettner@mail.schwarz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
27c5a095e2
commit
fa173a1b4e
|
@ -876,6 +876,7 @@ struct ctnetlink_filter_u32 {
|
|||
|
||||
struct ctnetlink_filter {
|
||||
u8 family;
|
||||
bool zone_filter;
|
||||
|
||||
u_int32_t orig_flags;
|
||||
u_int32_t reply_flags;
|
||||
|
@ -992,9 +993,12 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family)
|
|||
if (err)
|
||||
goto err_filter;
|
||||
|
||||
err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);
|
||||
if (err < 0)
|
||||
goto err_filter;
|
||||
if (cda[CTA_ZONE]) {
|
||||
err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);
|
||||
if (err < 0)
|
||||
goto err_filter;
|
||||
filter->zone_filter = true;
|
||||
}
|
||||
|
||||
if (!cda[CTA_FILTER])
|
||||
return filter;
|
||||
|
@ -1148,7 +1152,7 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data)
|
|||
if (filter->family && nf_ct_l3num(ct) != filter->family)
|
||||
goto ignore_entry;
|
||||
|
||||
if (filter->zone.id != NF_CT_DEFAULT_ZONE_ID &&
|
||||
if (filter->zone_filter &&
|
||||
!nf_ct_zone_equal_any(ct, &filter->zone))
|
||||
goto ignore_entry;
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@
|
|||
#include "../kselftest_harness.h"
|
||||
|
||||
#define TEST_ZONE_ID 123
|
||||
#define CTA_FILTER_F_CTA_TUPLE_ZONE (1 << 2)
|
||||
#define NF_CT_DEFAULT_ZONE_ID 0
|
||||
|
||||
static int reply_counter;
|
||||
|
||||
|
@ -336,6 +336,9 @@ FIXTURE_SETUP(conntrack_dump_flush)
|
|||
ret = conntrack_data_generate_v4(self->sock, 0xf4f4f4f4, 0xf5f5f5f5,
|
||||
TEST_ZONE_ID + 2);
|
||||
EXPECT_EQ(ret, 0);
|
||||
ret = conntrack_data_generate_v4(self->sock, 0xf6f6f6f6, 0xf7f7f7f7,
|
||||
NF_CT_DEFAULT_ZONE_ID);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
src = (struct in6_addr) {{
|
||||
.__u6_addr32 = {
|
||||
|
@ -395,6 +398,26 @@ FIXTURE_SETUP(conntrack_dump_flush)
|
|||
TEST_ZONE_ID + 2);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
src = (struct in6_addr) {{
|
||||
.__u6_addr32 = {
|
||||
0xb80d0120,
|
||||
0x00000000,
|
||||
0x00000000,
|
||||
0x07000000
|
||||
}
|
||||
}};
|
||||
dst = (struct in6_addr) {{
|
||||
.__u6_addr32 = {
|
||||
0xb80d0120,
|
||||
0x00000000,
|
||||
0x00000000,
|
||||
0x08000000
|
||||
}
|
||||
}};
|
||||
ret = conntrack_data_generate_v6(self->sock, src, dst,
|
||||
NF_CT_DEFAULT_ZONE_ID);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
ret = conntracK_count_zone(self->sock, TEST_ZONE_ID);
|
||||
EXPECT_GE(ret, 2);
|
||||
if (ret > 2)
|
||||
|
@ -425,6 +448,24 @@ TEST_F(conntrack_dump_flush, test_flush_by_zone)
|
|||
EXPECT_EQ(ret, 2);
|
||||
ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 2);
|
||||
EXPECT_EQ(ret, 2);
|
||||
ret = conntracK_count_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);
|
||||
EXPECT_EQ(ret, 2);
|
||||
}
|
||||
|
||||
TEST_F(conntrack_dump_flush, test_flush_by_zone_default)
|
||||
{
|
||||
int ret;
|
||||
|
||||
ret = conntrack_flush_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);
|
||||
EXPECT_EQ(ret, 0);
|
||||
ret = conntracK_count_zone(self->sock, TEST_ZONE_ID);
|
||||
EXPECT_EQ(ret, 2);
|
||||
ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 1);
|
||||
EXPECT_EQ(ret, 2);
|
||||
ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 2);
|
||||
EXPECT_EQ(ret, 2);
|
||||
ret = conntracK_count_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);
|
||||
EXPECT_EQ(ret, 0);
|
||||
}
|
||||
|
||||
TEST_HARNESS_MAIN
|
||||
|
|
Loading…
Reference in New Issue