From e53932f0e5de19bff8740454ec6952df343d45bb Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Mon, 27 Jul 2026 21:41:29 +0200 Subject: [PATCH] netfilter: conncount: normalize tuple and zone on successful ct lookup When get_ct_or_tuple_from_skb() falls back to looking for a connection via nf_conntrack_find_get(), a successful lookup sets ct but leaves tuple and zone unupdated. If the packet belongs to a reply flow, tuple will remain in the reply direction. As conncount relies on the original direction tuple to count the connections consistenly, passing an unnormalized reply tuple could lead to problems. Fix this by making sure that tuple and zone are normalized. Suggested-by: Florian Westphal Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conncount.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c index e9ea6d9466e7..85487f92af50 100644 --- a/net/netfilter/nf_conncount.c +++ b/net/netfilter/nf_conncount.c @@ -158,6 +158,8 @@ static bool get_ct_or_tuple_from_skb(struct net *net, return true; found_ct = nf_ct_tuplehash_to_ctrack(h); + *tuple = found_ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; + *zone = nf_ct_zone(found_ct); *refcounted = true; *ct = found_ct;