]> git.karo-electronics.de Git - karo-tx-linux.git/commitdiff
netfilter: nf_nat: don't check for port change on ICMP tuples
authorUlrich Weber <ulrich.weber@sophos.com>
Thu, 25 Oct 2012 05:34:45 +0000 (05:34 +0000)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 6 Dec 2012 11:20:10 +0000 (11:20 +0000)
commit 38fe36a248ec3228f8e6507955d7ceb0432d2000 upstream.

ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.

Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com>
[Pablo Neira Ayuso: Backported to.3.0]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/ipv4/netfilter/nf_nat_standalone.c

index 92900482edea3c469168bcdeed43e9a8eb58dc54..e32b54225be32891fe512216ef894b2780626a02 100644 (file)
@@ -194,7 +194,8 @@ nf_nat_out(unsigned int hooknum,
 
                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
-                   (ct->tuplehash[dir].tuple.src.u.all !=
+                   (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+                    ct->tuplehash[dir].tuple.src.u.all !=
                     ct->tuplehash[!dir].tuple.dst.u.all)
                   )
                        return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
@@ -230,7 +231,8 @@ nf_nat_local_fn(unsigned int hooknum,
                                ret = NF_DROP;
                }
 #ifdef CONFIG_XFRM
-               else if (ct->tuplehash[dir].tuple.dst.u.all !=
+               else if (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+                        ct->tuplehash[dir].tuple.dst.u.all !=
                         ct->tuplehash[!dir].tuple.src.u.all)
                        if (ip_xfrm_me_harder(skb))
                                ret = NF_DROP;