Commit fa173a1b authored by Felix Huettner's avatar Felix Huettner Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: fix filtering for zone 0 



previously filtering for the default zone would actually skip the zone
filter and flush all zones.

Fixes: eff3c558 ("netfilter: ctnetlink: support filtering by zone")
Reported-by: default avatarIlya Maximets <i.maximets@ovn.org>
Closes: https://lore.kernel.org/netdev/2032238f-31ac-4106-8f22-522e76df5a12@ovn.org/


Signed-off-by: default avatarFelix Huettner <felix.huettner@mail.schwarz>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 27c5a095

net/netfilter/nf_conntrack_netlink.c

+8 −4
Original line number Diff line number Diff line
@@ -876,6 +876,7 @@ struct ctnetlink_filter_u32 { 


struct ctnetlink_filter {

	u8 family;

	bool zone_filter;



	u_int32_t orig_flags;

	u_int32_t reply_flags;
@@ -992,9 +993,12 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 
	if (err)

		goto err_filter;



	if (cda[CTA_ZONE]) {

		err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);

		if (err < 0)

			goto err_filter;

		filter->zone_filter = true;

	}



	if (!cda[CTA_FILTER])

		return filter;
@@ -1148,7 +1152,7 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) 
	if (filter->family && nf_ct_l3num(ct) != filter->family)

		goto ignore_entry;



	if (filter->zone.id != NF_CT_DEFAULT_ZONE_ID &&

	if (filter->zone_filter &&

	    !nf_ct_zone_equal_any(ct, &filter->zone))

		goto ignore_entry;

tools/testing/selftests/netfilter/conntrack_dump_flush.c

+42 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
#include "../kselftest_harness.h"



#define TEST_ZONE_ID 123

#define CTA_FILTER_F_CTA_TUPLE_ZONE (1 << 2)

#define NF_CT_DEFAULT_ZONE_ID 0



static int reply_counter;
@@ -336,6 +336,9 @@ FIXTURE_SETUP(conntrack_dump_flush) 
	ret = conntrack_data_generate_v4(self->sock, 0xf4f4f4f4, 0xf5f5f5f5,

					 TEST_ZONE_ID + 2);

	EXPECT_EQ(ret, 0);

	ret = conntrack_data_generate_v4(self->sock, 0xf6f6f6f6, 0xf7f7f7f7,

					 NF_CT_DEFAULT_ZONE_ID);

	EXPECT_EQ(ret, 0);



	src = (struct in6_addr) {{

		.__u6_addr32 = {
@@ -395,6 +398,26 @@ FIXTURE_SETUP(conntrack_dump_flush) 
					 TEST_ZONE_ID + 2);

	EXPECT_EQ(ret, 0);



	src = (struct in6_addr) {{

		.__u6_addr32 = {

			0xb80d0120,

			0x00000000,

			0x00000000,

			0x07000000

		}

	}};

	dst = (struct in6_addr) {{

		.__u6_addr32 = {

			0xb80d0120,

			0x00000000,

			0x00000000,

			0x08000000

		}

	}};

	ret = conntrack_data_generate_v6(self->sock, src, dst,

					 NF_CT_DEFAULT_ZONE_ID);

	EXPECT_EQ(ret, 0);



	ret = conntracK_count_zone(self->sock, TEST_ZONE_ID);

	EXPECT_GE(ret, 2);

	if (ret > 2)
@@ -425,6 +448,24 @@ TEST_F(conntrack_dump_flush, test_flush_by_zone) 
	EXPECT_EQ(ret, 2);

	ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 2);

	EXPECT_EQ(ret, 2);

	ret = conntracK_count_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);

	EXPECT_EQ(ret, 2);

}



TEST_F(conntrack_dump_flush, test_flush_by_zone_default)

{

	int ret;



	ret = conntrack_flush_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);

	EXPECT_EQ(ret, 0);

	ret = conntracK_count_zone(self->sock, TEST_ZONE_ID);

	EXPECT_EQ(ret, 2);

	ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 1);

	EXPECT_EQ(ret, 2);

	ret = conntracK_count_zone(self->sock, TEST_ZONE_ID + 2);

	EXPECT_EQ(ret, 2);

	ret = conntracK_count_zone(self->sock, NF_CT_DEFAULT_ZONE_ID);

	EXPECT_EQ(ret, 0);

}



TEST_HARNESS_MAIN