netdev - Re: [PATCH resend] netfilter: place in source hash after SNAT is done

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D35A0F2.5010908@trash.net>
Date:	Tue, 18 Jan 2011 15:17:22 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Changli Gao <xiaosuo@...il.com>
CC:	"David S. Miller" <davem@...emloft.net>,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH resend] netfilter: place in source hash after SNAT is
 done

On 15.01.2011 12:28, Changli Gao wrote:
> If SNAT isn't done, the wrong info maybe got by the other cts.
> 
> As the filter table is after DNAT table, the packets dropped in filter
> table also bother bysource hash table.
> 
> Signed-off-by: Changli Gao <xiaosuo@...il.com>
> ---
>  net/ipv4/netfilter/nf_nat_core.c |   18 +++++++++++-------
>  1 file changed, 11 insertions(+), 7 deletions(-)
> diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
> index c04787c..51ce55a 100644
> --- a/net/ipv4/netfilter/nf_nat_core.c
> +++ b/net/ipv4/netfilter/nf_nat_core.c
> @@ -221,7 +221,14 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
>  	   manips not an issue.  */
>  	if (maniptype == IP_NAT_MANIP_SRC &&
>  	    !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
> -		if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) {
> +		/* try the original tuple first */

This doesn't seem to be related to the hashing change. Please describe
the intention behind this change.

> +		if (in_range(orig_tuple, range)) {
> +			if (!nf_nat_used_tuple(orig_tuple, ct)) {
> +				*tuple = *orig_tuple;
> +				return;
> +			}
> +		} else if (find_appropriate_src(net, zone, orig_tuple, tuple,
> +			   range)) {
>  			pr_debug("get_unique_tuple: Found current src map\n");
>  			if (!nf_nat_used_tuple(tuple, ct))
>  				return;


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html