From: Fernando Fernandez Mancera When get_ct_or_tuple_from_skb() falls back to looking for a connection via nf_conntrack_find_get(), a successful lookup sets ct but leaves tuple and zone unupdated. If the packet belongs to a reply flow, tuple will remain in the reply direction. As conncount relies on the original direction tuple to count the connections consistenly, passing an unnormalized reply tuple could lead to problems. Fix this by making sure that tuple and zone are normalized. Suggested-by: Florian Westphal Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conncount.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c index e9ea6d9466e7..85487f92af50 100644 --- a/net/netfilter/nf_conncount.c +++ b/net/netfilter/nf_conncount.c @@ -158,6 +158,8 @@ static bool get_ct_or_tuple_from_skb(struct net *net, return true; found_ct = nf_ct_tuplehash_to_ctrack(h); + *tuple = found_ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; + *zone = nf_ct_zone(found_ct); *refcounted = true; *ct = found_ct; -- 2.47.3