diff options
| author |   Florian Westphal <fw@strlen.de> | 2019-04-09 14:45:20 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2019-04-15 07:31:50 +0200 |
| commit | 5bdac418f33f60b07a34e01e722889140ee8fac9 (patch) | |
| tree | 8dd81d36f4c9ba89f4ad8779f8055e24f8069118 /tools/testing/nvdimm | |
| parent | netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook() (diff) | |
| download | linux-dev-5bdac418f33f60b07a34e01e722889140ee8fac9.tar.xz linux-dev-5bdac418f33f60b07a34e01e722889140ee8fac9.zip | |
netfilter: nat: fix icmp id randomization
Sven Auhagen reported that a 2nd ping request will fail if 'fully-random'
mode is used.
Reason is that if no proto information is given, min/max are both 0,
so we set the icmp id to 0 instead of chosing a random value between
0 and 65535.
Update test case as well to catch this, without fix this yields:
[..]
ERROR: cannot ping ns1 from ns2 with ip masquerade fully-random (attempt 2)
ERROR: cannot ping ns1 from ns2 with ipv6 masquerade fully-random (attempt 2)
... becaus 2nd ping clashes with existing 'id 0' icmp conntrack and gets
dropped.
Fixes: 203f2e78200c27e ("netfilter: nat: remove l4proto->unique_tuple")
Reported-by: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/testing/nvdimm')
0 files changed, 0 insertions, 0 deletions