netfilter: ctnetlink: Fix regression in conntrack entry deletion
authorFelix Kaechele <felix@kaechele.ca>
Tue, 25 Jun 2019 20:48:59 +0000 (16:48 -0400)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 26 Jun 2019 09:07:50 +0000 (11:07 +0200)
commite7600865db32b69deb0109b8254244dca592adcf
treea4dfc3033f0885425b348fab3e5f23a91cdec26a
parent5db7c8b9f9fc2aeec671ae3ca6375752c162e0e7
netfilter: ctnetlink: Fix regression in conntrack entry deletion

Commit f8e608982022 ("netfilter: ctnetlink: Resolve conntrack
L3-protocol flush regression") introduced a regression in which deletion
of conntrack entries would fail because the L3 protocol information
is replaced by AF_UNSPEC. As a result the search for the entry to be
deleted would turn up empty due to the tuple used to perform the search
is now different from the tuple used to initially set up the entry.

For flushing the conntrack table we do however want to keep the option
for nfgenmsg->version to have a non-zero value to allow for newer
user-space tools to request treatment under the new behavior. With that
it is possible to independently flush tables for a defined L3 protocol.
This was introduced with the enhancements in in commit 59c08c69c278
("netfilter: ctnetlink: Support L3 protocol-filter on flush").

Older user-space tools will retain the behavior of flushing all tables
regardless of defined L3 protocol.

Fixes: f8e608982022 ("netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression")
Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_netlink.c