Commit 8183e3a8 authored by Changli Gao's avatar Changli Gao Committed by Patrick McHardy
Browse files

netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario 



We use the reply tuples when limiting the connections by the destination
addresses, however, in SNAT scenario, the final reply tuples won't be
ready until SNAT is done in POSTROUING or INPUT chain, and the following
nf_conntrack_find_get() in count_tem() will get nothing, so connlimit
can't work as expected.

In this patch, the original tuples are always used, and an additional
member addr is appended to save the address in either end.

Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent f2247fbd

net/netfilter/xt_connlimit.c

+9 −11
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
struct xt_connlimit_conn {

	struct list_head		list;

	struct nf_conntrack_tuple	tuple;

	union nf_inet_addr		addr;

};



struct xt_connlimit_data {
@@ -151,7 +152,7 @@ static int count_them(struct net *net, 
			continue;

		}



		if (same_source_net(addr, mask, &conn->tuple.src.u3, family))

		if (same_source_net(addr, mask, &conn->addr, family))

			/* same source network -> be counted! */

			++matches;

		nf_ct_put(found_ct);
@@ -165,6 +166,7 @@ static int count_them(struct net *net, 
		if (conn == NULL)

			return -ENOMEM;

		conn->tuple = *tuple;

		conn->addr = *addr;

		list_add(&conn->list, hash);

		++matches;

	}
@@ -185,15 +187,11 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) 
	int connections;



	ct = nf_ct_get(skb, &ctinfo);

	if (ct != NULL) {

		if (info->flags & XT_CONNLIMIT_DADDR)

			tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;

		else

	if (ct != NULL)

		tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;

	} else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),

				    par->family, &tuple)) {

	else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),

				    par->family, &tuple))

		goto hotdrop;

	}



	if (par->family == NFPROTO_IPV6) {

		const struct ipv6hdr *iph = ipv6_hdr(skb);

CRA Git | Maintained and supported by SUSTech CRA and CCSE