Joe Stringer 4b31814d20 netfilter: nf_conntrack: Support expectations in different zones ...

When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.

Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2015-07-22 17:00:47 +02:00

..

ipset

netfilter: ipset: Fix coding styles reported by checkpatch.pl

2015-06-14 10:40:18 +02:00

ipvs

ipvs: call skb_sender_cpu_clear

2015-07-14 16:41:27 +09:00

core.c

netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook

2015-06-23 06:23:23 -07:00

Kconfig

netfilter: Kconfig: get rid of parens around depends on

2015-06-15 17:26:37 +02:00

Makefile

netfilter: nf_tables: add netdev table to filter from ingress

2015-05-26 18:41:23 +02:00

nf_conntrack_acct.c

netfilter: Remove uses of seq_<foo> return values

2015-03-18 10:51:35 +01:00

nf_conntrack_amanda.c

net: Remove state argument from skb_find_text()

2015-02-22 15:59:54 -05:00

nf_conntrack_broadcast.c

…

nf_conntrack_core.c

netfilter: fix netns dependencies with conntrack templates

2015-07-20 14:58:19 +02:00

nf_conntrack_ecache.c

…

nf_conntrack_expect.c

netfilter: nf_conntrack: Support expectations in different zones

2015-07-22 17:00:47 +02:00

nf_conntrack_extend.c

…

nf_conntrack_ftp.c

…

nf_conntrack_h323_asn1.c

…

nf_conntrack_h323_main.c

ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST

2015-05-25 13:25:33 -04:00

nf_conntrack_h323_types.c

…

nf_conntrack_helper.c

…

nf_conntrack_irc.c

…

nf_conntrack_l3proto_generic.c

…

nf_conntrack_labels.c

…

nf_conntrack_netbios_ns.c

…

nf_conntrack_netlink.c

netfilter: ctnetlink: put back references to master ct and expect objects

2015-07-10 14:18:03 +02:00

nf_conntrack_pptp.c

…

nf_conntrack_proto_dccp.c

…

nf_conntrack_proto_generic.c

netfilter: conntrack: warn the user if there is a better helper to use

2015-06-12 14:06:24 +02:00

nf_conntrack_proto_gre.c

…

nf_conntrack_proto_sctp.c

…

nf_conntrack_proto_tcp.c

conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition

2015-05-15 20:50:56 +02:00

nf_conntrack_proto_udp.c

…

nf_conntrack_proto_udplite.c

…

nf_conntrack_proto.c

…

nf_conntrack_sane.c

…

nf_conntrack_seqadj.c

netfilter: nf_ct_seqadj: print ack seq in the right host byte order

2015-01-05 13:52:20 +01:00

nf_conntrack_sip.c

…

nf_conntrack_snmp.c

…

nf_conntrack_standalone.c

…

nf_conntrack_tftp.c

…

nf_conntrack_timeout.c

…

nf_conntrack_timestamp.c

…

nf_internals.h

netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook

2015-06-23 06:23:23 -07:00

nf_log_common.c

netfilter: bridge: add helpers for fetching physin/outdev

2015-04-08 16:49:08 +02:00

nf_log.c

netfilter: restore rule tracing via nfnetlink_log

2015-03-19 11:14:48 +01:00

nf_nat_amanda.c

…

nf_nat_core.c

…

nf_nat_ftp.c

…

nf_nat_helper.c

…

nf_nat_irc.c

…

nf_nat_proto_common.c

…

nf_nat_proto_dccp.c

…

nf_nat_proto_sctp.c

…

nf_nat_proto_tcp.c

…

nf_nat_proto_udp.c

…

nf_nat_proto_udplite.c

…

nf_nat_proto_unknown.c

…

nf_nat_redirect.c

…

nf_nat_sip.c

…

nf_nat_tftp.c

…

nf_queue.c

netfilter: nf_queue: Don't recompute the hook_list head

2015-07-02 15:03:13 +02:00

nf_sockopt.c

…

nf_synproxy_core.c

netfilter: fix netns dependencies with conntrack templates

2015-07-20 14:58:19 +02:00

nf_tables_api.c

netfilter: nf_tables_netdev: unregister hooks on net_device removal

2015-06-15 23:02:35 +02:00

nf_tables_core.c

netfilter: nftables: Do not run chains in the wrong network namespace

2015-06-23 06:23:22 -07:00

nf_tables_inet.c

…

nf_tables_netdev.c

netfilter: nf_tables_netdev: unregister hooks on net_device removal

2015-06-15 23:02:35 +02:00

nfnetlink_acct.c

…

nfnetlink_cthelper.c

netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()

2015-03-12 13:07:36 +01:00

nfnetlink_cttimeout.c

…

nfnetlink_log.c

netfilter: Kill unused copies of RCV_SKB_FAIL

2015-06-18 21:14:27 +02:00

nfnetlink_queue_core.c

netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook

2015-06-23 06:23:23 -07:00

nfnetlink_queue_ct.c

…

nfnetlink.c

netfilter: nfnetlink: keep going batch handling on missing modules

2015-07-02 17:59:33 +02:00

nft_bitwise.c

netfilter: nf_tables: support variable sized data in nft_data_init()

2015-04-13 17:17:30 +02:00

nft_byteorder.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_cmp.c

netfilter: nf_tables: support variable sized data in nft_data_init()

2015-04-13 17:17:30 +02:00

nft_compat.c

netfilter: x_tables: add context to know if extension runs from nft_compat

2015-05-15 20:14:07 +02:00

nft_counter.c

netfilter: nf_tables: mark stateful expressions

2015-04-13 20:12:31 +02:00

nft_ct.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_dynset.c

netfilter: nft_dynset: dynamic stateful expression instantiation

2015-04-13 20:19:55 +02:00

nft_exthdr.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_hash.c

netfilter: nf_tables: variable sized set element keys / data

2015-04-13 17:17:31 +02:00

nft_immediate.c

netfilter: nf_tables: support variable sized data in nft_data_init()

2015-04-13 17:17:30 +02:00

nft_limit.c

netfilter: nf_tables: mark stateful expressions

2015-04-13 20:12:31 +02:00

nft_log.c

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13 17:17:07 +02:00

nft_lookup.c

netfilter: nf_tables: add flag to indicate set contains expressions

2015-04-13 20:12:32 +02:00

nft_masq.c

netfilter: nf_tables: validate hooks in NAT expressions

2015-01-19 14:52:39 +01:00

nft_meta.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_nat.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_payload.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_queue.c

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13 17:17:07 +02:00

nft_rbtree.c

netfilter: nf_tables: variable sized set element keys / data

2015-04-13 17:17:31 +02:00

nft_redir.c

netfilter: nf_tables: add register parsing/dumping helpers

2015-04-13 17:17:28 +02:00

nft_reject_inet.c

netfilter; Add some missing default cases to switch statements in nft_reject.

2015-04-27 13:20:34 -04:00

nft_reject.c

netfilter; Add some missing default cases to switch statements in nft_reject.

2015-04-27 13:20:34 -04:00

x_tables.c

netfilter: x_tables: remove XT_TABLE_INFO_SZ and a dereference.

2015-06-15 20:19:20 +02:00

xt_addrtype.c

ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST

2015-05-25 13:25:33 -04:00

xt_AUDIT.c

…

xt_bpf.c

…

xt_cgroup.c

netfilter: x_tables: fix cgroup matching on non-full sks

2015-04-01 11:26:42 +02:00

xt_CHECKSUM.c

…

xt_CLASSIFY.c

…

xt_cluster.c

…

xt_comment.c

…

xt_connbytes.c

…

xt_connlabel.c

…

xt_connlimit.c

…

xt_connmark.c

…

xt_CONNSECMARK.c

…

xt_conntrack.c

…

xt_cpu.c

…

xt_CT.c

netfilter: fix netns dependencies with conntrack templates

2015-07-20 14:58:19 +02:00

xt_dccp.c

…

xt_devgroup.c

…

xt_dscp.c

…

xt_DSCP.c

…

xt_ecn.c

…

xt_esp.c

…

xt_hashlimit.c

…

xt_helper.c

…

xt_hl.c

…

xt_HL.c

…

xt_HMARK.c

…

xt_IDLETIMER.c

netfilter: IDLETIMER: fix lockdep warning

2015-07-13 17:23:25 +02:00

xt_ipcomp.c

…

xt_iprange.c

…

xt_ipvs.c

…

xt_l2tp.c

…

xt_LED.c

…

xt_length.c

…

xt_limit.c

…

xt_LOG.c

…

xt_mac.c

…

xt_mark.c

netfilter: xt_MARK: Add ARP support

2015-05-14 13:00:27 +02:00

xt_multiport.c

…

xt_nat.c

…

xt_NETMAP.c

…

xt_nfacct.c

…

xt_NFLOG.c

…

xt_NFQUEUE.c

…

xt_osf.c

netfilter: xt_osf: Use continue to reduce indentation

2014-12-23 14:20:10 +01:00

xt_owner.c

…

xt_physdev.c

netfilter: physdev: use helpers

2015-04-08 16:49:09 +02:00

xt_pkttype.c

…

xt_policy.c

…

xt_quota.c

…

xt_rateest.c

…

xt_RATEEST.c

…

xt_realm.c

…

xt_recent.c

netfilter: xt_recent: don't reject rule if new hitcount exceeds table max

2015-02-16 17:00:47 +01:00

xt_REDIRECT.c

…

xt_repldata.h

…

xt_sctp.c

…

xt_SECMARK.c

…

xt_set.c

netfilter: ipset: Fix coding styles reported by checkpatch.pl

2015-06-14 10:40:18 +02:00

xt_socket.c

netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag

2015-06-18 13:05:09 +02:00

xt_state.c

…

xt_statistic.c

…

xt_string.c

net: Remove state argument from skb_find_text()

2015-02-22 15:59:54 -05:00

xt_tcpmss.c

…

xt_TCPMSS.c

netfilter: x_tables: add context to know if extension runs from nft_compat

2015-05-15 20:14:07 +02:00

xt_TCPOPTSTRIP.c

…

xt_tcpudp.c

…

xt_TEE.c

ipv6: Set FLOWI_FLAG_KNOWN_NH at flowi6_flags

2015-05-25 13:25:34 -04:00

xt_time.c

…

xt_TPROXY.c

tcp/dccp: get rid of central timewait timer

2015-04-13 16:40:05 -04:00

xt_TRACE.c

…

xt_u32.c

…