tree 2df27a0099a40362eebd1a1a6be182d52134a550
parent fc6ddbecce440df74fb4491c17c372b52cf5be83
author Yi-Hung Wei <yihung.wei@gmail.com> 1528825894 -0700
committer Pablo Neira Ayuso <pablo@netfilter.org> 1528826827 +0200

netfilter: nf_conncount: Fix garbage collection with zones

Currently, we use check_hlist() for garbage colleciton. However, we
use the ‘zone’ from the counted entry to query the existence of
existing entries in the hlist. This could be wrong when they are in
different zones, and this patch fixes this issue.

Fixes: e59ea3df3fc2 ("netfilter: xt_connlimit: honor conntrack zone if available")
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>