diff options
author | Florian Westphal <fw@strlen.de> | 2017-04-20 10:11:34 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-04-26 09:30:22 +0200 |
commit | 2fe7c321ab54d391dffb98911f5fb5cd315d6526 (patch) | |
tree | dc5e6be751cd3fbc3c99350362e514b8f5abc5fa /net/netfilter/nf_conntrack_pptp.c | |
parent | ff459018d7cb13e43ee2f857949c26b235ccd9a5 (diff) | |
download | op-kernel-dev-2fe7c321ab54d391dffb98911f5fb5cd315d6526.zip op-kernel-dev-2fe7c321ab54d391dffb98911f5fb5cd315d6526.tar.gz |
netfilter: pptp: attach nat extension when needed
make sure nat extension gets added if the master conntrack is subject to
NAT. This will be required once the nat core stops adding it by default.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_pptp.c')
-rw-r--r-- | net/netfilter/nf_conntrack_pptp.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c index 1260319..6959e93 100644 --- a/net/netfilter/nf_conntrack_pptp.c +++ b/net/netfilter/nf_conntrack_pptp.c @@ -263,7 +263,7 @@ out_unexpect_orig: goto out_put_both; } -static inline int +static int pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff, struct PptpControlHeader *ctlh, union pptp_ctrl_union *pptpReq, @@ -391,7 +391,7 @@ invalid: return NF_ACCEPT; } -static inline int +static int pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff, struct PptpControlHeader *ctlh, union pptp_ctrl_union *pptpReq, @@ -523,6 +523,14 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff, int ret; u_int16_t msg; +#if IS_ENABLED(CONFIG_NF_NAT) + if (!nf_ct_is_confirmed(ct) && (ct->status & IPS_NAT_MASK)) { + struct nf_conn_nat *nat = nf_ct_ext_find(ct, NF_CT_EXT_NAT); + + if (!nat && !nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC)) + return NF_DROP; + } +#endif /* don't do any tracking before tcp handshake complete */ if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY) return NF_ACCEPT; |