Commit b0aeef30 authored by Julian Anastasov's avatar Julian Anastasov Committed by Simon Horman
Browse files

nf_nat: restrict ICMP translation for embedded header 



 	Skip ICMP translation of embedded protocol header
if NAT bits are not set. Needed for IPVS to see the original
embedded addresses because for IPVS traffic the IPS_SRC_NAT_BIT
and IPS_DST_NAT_BIT bits are not set. It happens when IPVS performs
DNAT for client packets after using nf_conntrack_alter_reply
to expect replies from real server.

Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent 0d79641a

net/ipv4/netfilter/nf_nat_core.c

+15 −14
Original line number Diff line number Diff line
@@ -462,6 +462,18 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct, 
			return 0;

	}



	if (manip == IP_NAT_MANIP_SRC)

		statusbit = IPS_SRC_NAT;

	else

		statusbit = IPS_DST_NAT;



	/* Invert if this is reply dir. */

	if (dir == IP_CT_DIR_REPLY)

		statusbit ^= IPS_NAT_MASK;



	if (!(ct->status & statusbit))

		return 1;



	pr_debug("icmp_reply_translation: translating error %p manip %u "

		 "dir %s\n", skb, manip,

		 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");
@@ -496,20 +508,9 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct, 


	/* Change outer to look the reply to an incoming packet

	 * (proto 0 means don't invert per-proto part). */

	if (manip == IP_NAT_MANIP_SRC)

		statusbit = IPS_SRC_NAT;

	else

		statusbit = IPS_DST_NAT;



	/* Invert if this is reply dir. */

	if (dir == IP_CT_DIR_REPLY)

		statusbit ^= IPS_NAT_MASK;



	if (ct->status & statusbit) {

	nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);

	if (!manip_pkt(0, skb, 0, &target, manip))

		return 0;

	}



	return 1;

}