[NETFILTER]: NAT range calculation fix.

This patch fixes a logic bug in NAT range calculations, which also
causes a large slowdown when ICMP floods go through NAT.

Author: Karlis Peisenieks

net/ipv4/netfilter/ip_nat_core.c

@@ -157,8 +157,8 @@ in_range(const struct ip_conntrack_tuple *tuple,
 				continue;
 		}
 
-		if ((mr->range[i].flags & IP_NAT_RANGE_PROTO_SPECIFIED)
-		    && proto->in_range(&newtuple, IP_NAT_MANIP_SRC,
+		if (!(mr->range[i].flags & IP_NAT_RANGE_PROTO_SPECIFIED)
+		    || proto->in_range(&newtuple, IP_NAT_MANIP_SRC,
 				       &mr->range[i].min, &mr->range[i].max))
 			return 1;
 	}