netfilter: conntrack: skip identical origin tuple in same zone only

[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ]

The origin skip check needs to re-test the zone. Else, we might skip
a colliding tuple in the reply direction.

This only occurs when using 'directional zones' where origin tuples
reside in different zones but the reply tuples share the same zone.

This causes the new conntrack entry to be dropped at confirmation time
because NAT clash resolution was elided.

Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 8064d769c953cf8e056d6bd61f833d1092dbdc2c..ede0ab5dc400a2de36df8688af5b1d1b81f5c4de 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -939,7 +939,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
                         * Let nf_ct_resolve_clash() deal with this later.
                         */
                        if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-                                             &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
+                                             &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
+                                             nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
                                continue;
 
                        NF_CT_STAT_INC_ATOMIC(net, found);