diff options
| author | Julian Anastasov <ja@ssi.bg> | 2011-06-16 17:29:22 +0200 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-06-16 17:29:22 +0200 |
| commit | 42c1edd345c8412d96e7a362ee06feb7be73bb6c (patch) | |
| tree | 5b05b0324b8186fe8bc40ffced48c856b099547d /net | |
| parent | 2c38de4c1f8da799bdca0e4bb40ca13f2174d3e8 (diff) | |
| download | op-kernel-dev-42c1edd345c8412d96e7a362ee06feb7be73bb6c.zip op-kernel-dev-42c1edd345c8412d96e7a362ee06feb7be73bb6c.tar.gz | |
netfilter: nf_nat: avoid double seq_adjust for loopback
Avoid double seq adjustment for loopback traffic
because it causes silent repetition of TCP data. One
example is passive FTP with DNAT rule and difference in the
length of IP addresses.
This patch adds check if packet is sent and
received via loopback device. As the same conntrack is
used both for outgoing and incoming direction, we restrict
seq adjustment to happen only in POSTROUTING.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index db10075..de9da21 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -121,7 +121,9 @@ static unsigned int ipv4_confirm(unsigned int hooknum, return ret; } - if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) { + /* adjust seqs for loopback traffic only in outgoing direction */ + if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && + !nf_is_loopback_packet(skb)) { typeof(nf_nat_seq_adjust_hook) seq_adjust; seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook); |
