diff options
| author |   wenxu <wenxu@ucloud.cn> | 2020-05-30 13:54:51 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2020-05-30 17:57:58 -0700 |
| commit | 05aa69e5cba61d8900970a364825f854401694ec (patch) | |
| tree | 27046712fb95affd4887ef64fcc30f983302d88e | |
| parent | devinet: fix memleak in inetdev_init() (diff) | |
| download | wireguard-linux-05aa69e5cba61d8900970a364825f854401694ec.tar.xz wireguard-linux-05aa69e5cba61d8900970a364825f854401694ec.zip | |
net/sched: act_ct: add nat mangle action only for NAT-conntrack
Currently add nat mangle action with comparing invert and orig tuple.
It is better to check IPS_NAT_MASK flags first to avoid non necessary
memcmp for non-NAT conntrack.
Signed-off-by: wenxu <wenxu@ucloud.cn>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/act_ct.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 1a766393be62..20577355235a 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -199,6 +199,9 @@ static int tcf_ct_flow_table_add_action_nat(struct net *net, const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; struct nf_conntrack_tuple target; + if (!(ct->status & IPS_NAT_MASK)) + return 0; + nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); switch (tuple->src.l3num) { |