-
Changli Gao authored
We use the reply tuples when limiting the connections by the destination addresses, however, in SNAT scenario, the final reply tuples won't be ready until SNAT is done in POSTROUING or INPUT chain, and the following nf_conntrack_find_get() in count_tem() will get nothing, so connlimit can't work as expected. In this patch, the original tuples are always used, and an additional member addr is appended to save the address in either end. Signed-off-by:
Changli Gao <xiaosuo@gmail.com> Signed-off-by:
Patrick McHardy <kaber@trash.net>
8183e3a8