• Florian Westphal's avatar
    netfilter: nat: fix icmp id randomization · 5bdac418
    Florian Westphal authored
    Sven Auhagen reported that a 2nd ping request will fail if 'fully-random'
    mode is used.
    
    Reason is that if no proto information is given, min/max are both 0,
    so we set the icmp id to 0 instead of chosing a random value between
    0 and 65535.
    
    Update test case as well to catch this, without fix this yields:
    [..]
    ERROR: cannot ping ns1 from ns2 with ip masquerade fully-random (attempt 2)
    ERROR: cannot ping ns1 from ns2 with ipv6 masquerade fully-random (attempt 2)
    
    ... becaus 2nd ping clashes with existing 'id 0' icmp conntrack and gets
    dropped.
    
    Fixes: 203f2e78 ("netfilter: nat: remove l4proto->unique_tuple")
    Reported-by: default avatarSven Auhagen <sven.auhagen@voleatech.de>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    5bdac418
nf_nat_core.c 31.7 KB