diff options
| author |   Patrick McHardy <kaber@trash.net> | 2005-04-24 18:41:38 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2005-04-24 18:41:38 -0700 |
| commit | e281e3ac2b6c294d672034909883e7bb9e649ac7 (patch) | |
| tree | 0a7a13aa6ecaddf030a8ec5deecce87ee424aae7 /net/ipv4/netfilter/ip_nat_core.c | |
| parent | [PATCH] ppc trivial iomem annotations: pmac_smp.c (diff) | |
| download | linux-dev-e281e3ac2b6c294d672034909883e7bb9e649ac7.tar.xz linux-dev-e281e3ac2b6c294d672034909883e7bb9e649ac7.zip | |
[NETFILTER]: Fix NAT sequence number adjustment
The NAT changes in 2.6.11 changed the position where helpers
are called and perform packet mangling. Before 2.6.11, a NAT
helper was called before the packet was NATed and had its
sequence number adjusted. Since 2.6.11, the helpers get packets
with already adjusted sequence numbers.
This breaks sequence number adjustment, adjust_tcp_sequence()
needs the original sequence number to determine whether
a packet was a retransmission and to store it for further
corrections. It can't be reconstructed without more information
than available, so this patch restores the old order by
calling helpers from a new conntrack hook two priorities
below ip_conntrack_confirm() and adjusting the sequence number
from a new NAT hook one priority below ip_conntrack_confirm().
Tracked down by Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | net/ipv4/netfilter/ip_nat_core.c | 9 |
1 files changed, 0 insertions, 9 deletions
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c index 162ceacfc29a..9fc6f93af0dd 100644 --- a/net/ipv4/netfilter/ip_nat_core.c +++ b/net/ipv4/netfilter/ip_nat_core.c @@ -356,15 +356,6 @@ unsigned int nat_packet(struct ip_conntrack *ct, unsigned long statusbit; enum ip_nat_manip_type mtype = HOOK2MANIP(hooknum); - if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) - && (hooknum == NF_IP_POST_ROUTING || hooknum == NF_IP_LOCAL_IN)) { - DEBUGP("ip_nat_core: adjusting sequence number\n"); - /* future: put this in a l4-proto specific function, - * and call this function here. */ - if (!ip_nat_seq_adjust(pskb, ct, ctinfo)) - return NF_DROP; - } - if (mtype == IP_NAT_MANIP_SRC) statusbit = IPS_SRC_NAT; else |