diff options
author | Patrick McHardy <kaber@trash.net> | 2007-03-22 19:30:29 (GMT) |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2007-03-22 19:30:29 (GMT) |
commit | 848c29fd648e78fa87d0e399223826ce5dfc1b7a (patch) | |
tree | e76dac40d1d318f98bfdfe604ae43a29dec85ff9 /net/ipv4/netfilter/nf_nat_standalone.c | |
parent | ca8fbb859c42c9a402c5c19fd0588d89ae4988ba (diff) | |
download | linux-fsl-qoriq-848c29fd648e78fa87d0e399223826ce5dfc1b7a.tar.xz |
[NETFILTER]: nat: avoid rerouting packets if only XFRM policy key changed
Currently NAT not only reroutes packets in the OUTPUT chain when the
routing key changed, but also if only the non-routing part of the
IPsec policy key changed. This breaks ping -I since it doesn't use
SO_BINDTODEVICE but IP_PKTINFO cmsg to specify the output device, and
this information is lost.
Only do full rerouting if the routing key changed, and just do a new
policy lookup with the old route if only the ports changed.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/nf_nat_standalone.c')
-rw-r--r-- | net/ipv4/netfilter/nf_nat_standalone.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c index e4d3ef1..15aa3db 100644 --- a/net/ipv4/netfilter/nf_nat_standalone.c +++ b/net/ipv4/netfilter/nf_nat_standalone.c @@ -245,14 +245,16 @@ nf_nat_local_fn(unsigned int hooknum, enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); if (ct->tuplehash[dir].tuple.dst.u3.ip != - ct->tuplehash[!dir].tuple.src.u3.ip -#ifdef CONFIG_XFRM - || ct->tuplehash[dir].tuple.dst.u.all != - ct->tuplehash[!dir].tuple.src.u.all -#endif - ) + ct->tuplehash[!dir].tuple.src.u3.ip) { if (ip_route_me_harder(pskb, RTN_UNSPEC)) ret = NF_DROP; + } +#ifdef CONFIG_XFRM + else if (ct->tuplehash[dir].tuple.dst.u.all != + ct->tuplehash[!dir].tuple.src.u.all) + if (ip_xfrm_me_harder(pskb)) + ret = NF_DROP; +#endif } return ret; } |