| commit | ad86e1f27a9a97a9e50810b10bca678407b1d6fd | |
| author | Jan Engelhardt <jengelh@medozas.de> | |
| Wed, 26 Jan 2011 10:50:03 +0000 (26 11:50 +0100) | ||
| committer | Jan Engelhardt <jengelh@medozas.de> | |
| Wed, 26 Jan 2011 12:01:39 +0000 (26 13:01 +0100) | ||
| tree | 1ad952ca2f4e5b4e9e4a950861199aaaf9537117 | treesnapshot (tar.gz zip) |
| parent | 4b3fd57138c969dd940651fadf90db627254edbf | commitdiff |
netfilter: xt_connlimit: pick right dstaddr in NAT scenario
xt_connlimit normally records the "original" tuples in a hashlist
(such as "1.2.3.4 -> 5.6.7.8"), and looks in this list for iph->daddr
when counting.
When the user however uses DNAT in PREROUTING, looking for
iph->daddr -- which is now 192.168.9.10 -- will not match. Thus in
daddr mode, we need to record the reverse direction tuple
("192.168.9.10 -> 1.2.3.4") instead. In the reverse tuple, the dst
addr is on the src side, which is convenient, as count_them still uses
&conn->tuple.src.u3.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
xt_connlimit normally records the "original" tuples in a hashlist
(such as "1.2.3.4 -> 5.6.7.8"), and looks in this list for iph->daddr
when counting.
When the user however uses DNAT in PREROUTING, looking for
iph->daddr -- which is now 192.168.9.10 -- will not match. Thus in
daddr mode, we need to record the reverse direction tuple
("192.168.9.10 -> 1.2.3.4") instead. In the reverse tuple, the dst
addr is on the src side, which is convenient, as count_them still uses
&conn->tuple.src.u3.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| net/netfilter/xt_connlimit.c | diffblobblamehistory |