Commit a2d21502 authored by Rusty Russell's avatar Rusty Russell Committed by David S. Miller

[NETFILTER]: Cleanup find_appropriate_src() Fix

The fix to find_appropriate_src left a stupid test, which has no
effect but is incoherent at best.  It covers a corner case: if a
previous connection from this source was mapped onto a different IP
address (because it was explicitly told to), should the next one be
mapped that was as well, if no explicit rule says to remap the src IP?

I think the answer is yes: unless the user explicitly tells us to map
into a particular range, we should follow the Kegel draft.
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cf90340e
...@@ -128,16 +128,13 @@ in_range(const struct ip_conntrack_tuple *tuple, ...@@ -128,16 +128,13 @@ in_range(const struct ip_conntrack_tuple *tuple,
unsigned int i; unsigned int i;
for (i = 0; i < mr->rangesize; i++) { for (i = 0; i < mr->rangesize; i++) {
/* If we are allowed to map IPs, then we must be in the /* If we are supposed to map IPs, then we must be in the
range specified, otherwise we must be unchanged. */ range specified. */
if (mr->range[i].flags & IP_NAT_RANGE_MAP_IPS) { if (mr->range[i].flags & IP_NAT_RANGE_MAP_IPS) {
if (ntohl(tuple->src.ip) < ntohl(mr->range[i].min_ip) if (ntohl(tuple->src.ip) < ntohl(mr->range[i].min_ip)
|| (ntohl(tuple->src.ip) || (ntohl(tuple->src.ip)
> ntohl(mr->range[i].max_ip))) > ntohl(mr->range[i].max_ip)))
continue; continue;
} else {
if (tuple->src.ip != tuple->src.ip)
continue;
} }
if (!(mr->range[i].flags & IP_NAT_RANGE_PROTO_SPECIFIED) if (!(mr->range[i].flags & IP_NAT_RANGE_PROTO_SPECIFIED)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment