diff options
| author | Harald Welte <laforge@netfilter.org> | 2005-08-08 11:50:55 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-08-08 11:48:28 -0700 |
| commit | 8b83bc77bf77cc8459cb94e52b08e775104c4c48 (patch) | |
| tree | 89f84bdd6a13763882636913852c6ce2eaea199c /net | |
| parent | 48de5beeb0ee821859c79ba5b9462654604d8bf3 (diff) | |
| download | op-kernel-dev-8b83bc77bf77cc8459cb94e52b08e775104c4c48.zip op-kernel-dev-8b83bc77bf77cc8459cb94e52b08e775104c4c48.tar.gz | |
[PATCH] don't try to do any NAT on untracked connections
With the introduction of 'rustynat' in 2.6.11, the old tricks of preventing
NAT of 'untracked' connections (e.g. NOTRACK target in 'raw' table) are no
longer sufficient.
The ip_conntrack_untracked.status |= IPS_NAT_DONE_MASK effectively
prevents iteration of the 'nat' table, but doesn't prevent nat_packet()
to be executed. Since nr_manips is gone in 'rustynat', nat_packet() now
implicitly thinks that it has to do NAT on the packet.
This patch fixes that problem by explicitly checking for
ip_conntrack_untracked in ip_nat_fn().
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/netfilter/ip_nat_standalone.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c index bc59d0d..91d5ea1 100644 --- a/net/ipv4/netfilter/ip_nat_standalone.c +++ b/net/ipv4/netfilter/ip_nat_standalone.c @@ -102,6 +102,10 @@ ip_nat_fn(unsigned int hooknum, return NF_ACCEPT; } + /* Don't try to NAT if this packet is not conntracked */ + if (ct == &ip_conntrack_untracked) + return NF_ACCEPT; + switch (ctinfo) { case IP_CT_RELATED: case IP_CT_RELATED+IP_CT_IS_REPLY: |
