[PATCH nf-next] netfilter: conncount: normalize tuple and zone on successful ct lookup

When get_ct_or_tuple_from_skb() falls back to looking u a connection via
nf_conntrack_find_get(), a successful lookup sets ct but leaves tuple
and zone unupdated.

If the packet belongs to a reply flow, tuple will remain in the reply
direction. As conncount relies on the original direction tuple to count
the connections consistenly, passing an unnormalized reply tuple could
lead to problems.

Fix this by making sure that tuple and zone are normalized.

Suggested-by: Florian Westphal <[email protected]>
Signed-off-by: Fernando Fernandez Mancera <[email protected]>
---
Note: I am sending it to nf-next because I couldn't reproduce this issue
pointed out by Sashiko. Having said that, I still think the change
should be done because it makes sense and for consistency reasons
(aboved we are using the original direction too).
---
 net/netfilter/nf_conncount.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 91582069f6d2..4a62d3bef711 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -158,6 +158,8 @@ static bool get_ct_or_tuple_from_skb(struct net *net,
 		return true;
 
 	found_ct = nf_ct_tuplehash_to_ctrack(h);
+	*tuple = found_ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+	*zone = nf_ct_zone(found_ct);
 	*refcounted = true;
 	*ct = found_ct;
 
-- 
2.55.0