Commit 8aad8a72 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: Apply PRE_ROUTING manips in LOCAL_OUT for locally generated icmp errors

Locally generated ICMP errors never hit PRE_ROUTING. Fixes invalid
addressed ICMP errors for SNATed packets.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 50cce6d2
...@@ -880,6 +880,14 @@ icmp_reply_translation(struct sk_buff **pskb, ...@@ -880,6 +880,14 @@ icmp_reply_translation(struct sk_buff **pskb,
/* Mapping the inner packet is just like a normal packet, except /* Mapping the inner packet is just like a normal packet, except
* it was never src/dst reversed, so where we would normally * it was never src/dst reversed, so where we would normally
* apply a dst manip, we apply a src, and vice versa. */ * apply a dst manip, we apply a src, and vice versa. */
/* Only true for forwarded packets, locally generated packets
* never hit PRE_ROUTING, we need to apply their PRE_ROUTING
* manips in LOCAL_OUT. */
if (hooknum == NF_IP_LOCAL_OUT &&
info->manips[i].hooknum == NF_IP_PRE_ROUTING)
hooknum = info->manips[i].hooknum;
if (info->manips[i].hooknum != hooknum) if (info->manips[i].hooknum != hooknum)
continue; continue;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment