Merge tag 'hwmon-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groec...

[linux.git] / net / netfilter / nf_conncount.c

diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index dd67004a5cc09e4218f8c4c7bbef76f0f8afb93e..e9ea6d9466e74c190315be99f814987dfbfbb0cd 100644 (file)
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -183,17 +183,16 @@ static int __nf_conncount_add(struct net *net,
                return -ENOENT;
 
        if (ct && nf_ct_is_confirmed(ct)) {
-               /* local connections are confirmed in postrouting so confirmation
-                * might have happened before hitting connlimit
+               /* Connection is confirmed but might still be in the setup phase.
+                * Only skip the tracking if it is fully assured. This guarantees
+                * that setup packets or retransmissions are properly counted and
+                * deduplicated.
                 */
-               if (skb->skb_iif != LOOPBACK_IFINDEX) {
+               if (test_bit(IPS_ASSURED_BIT, &ct->status)) {
                        err = -EEXIST;
                        goto out_put;
                }
 
-               /* this is likely a local connection, skip optimization to avoid
-                * adding duplicates from a 'packet train'
-                */
                goto check_connections;
        }
 
@@ -212,8 +211,8 @@ check_connections:
                        /* Not found, but might be about to be confirmed */
                        if (PTR_ERR(found) == -EAGAIN) {
                                if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
-                                   nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
-                                   nf_ct_zone_id(zone, zone->dir))
+                                   nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) ==
+                                   nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL))
                                        goto out_put; /* already exists */
                        } else {
                                collect++;
@@ -224,7 +223,7 @@ check_connections:
                found_ct = nf_ct_tuplehash_to_ctrack(found);
 
                if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
-                   nf_ct_zone_equal(found_ct, zone, zone->dir)) {
+                   nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) {
                        /*
                         * We should not see tuples twice unless someone hooks
                         * this into a table without "-p tcp --syn".