Commit 13c62f53 authored by Marcelo Ricardo Leitner's avatar Marcelo Ricardo Leitner Committed by David S. Miller
Browse files

net/sched: act_ct: handle DNAT tuple collision 



This this the counterpart of 8aa7b526 ("openvswitch: handle DNAT
tuple collision") for act_ct. From that commit changelog:

"""
With multiple DNAT rules it's possible that after destination
translation the resulting tuples collide.

...

Netfilter handles this case by allocating a null binding for SNAT at
egress by default.  Perform the same operation in openvswitch for DNAT
if no explicit SNAT is requested by the user and allocate a null binding
for SNAT for packets in the "original" direction.
"""

Fixes: 95219afb ("act_ct: support asymmetric conntrack")
Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d2e381c4

net/sched/act_ct.c

+13 −8
Original line number Diff line number Diff line
@@ -904,14 +904,19 @@ static int tcf_ct_act_nat(struct sk_buff *skb, 
	}



	err = ct_nat_execute(skb, ct, ctinfo, range, maniptype);

	if (err == NF_ACCEPT &&

	    ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {

	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {

		if (ct->status & IPS_SRC_NAT) {

			if (maniptype == NF_NAT_MANIP_SRC)

				maniptype = NF_NAT_MANIP_DST;

			else

				maniptype = NF_NAT_MANIP_SRC;



		err = ct_nat_execute(skb, ct, ctinfo, range, maniptype);

			err = ct_nat_execute(skb, ct, ctinfo, range,

					     maniptype);

		} else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {

			err = ct_nat_execute(skb, ct, ctinfo, NULL,

					     NF_NAT_MANIP_SRC);

		}

	}

	return err;

#else