Commit c65ef8dc authored by Andrew Collins's avatar Andrew Collins Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_nat: Also handle non-ESTABLISHED routing changes in MASQUERADE 



Since (a0ecb85a netfilter: nf_nat: Handle routing changes in MASQUERADE
target), the MASQUERADE target handles routing changes which affect
the output interface of a connection, but only for ESTABLISHED
connections.  It is also possible for NEW connections which
already have a conntrack entry to be affected by routing changes.

This adds a check to drop entries in the NEW+conntrack state
when the oif has changed.

Signed-off-by: default avatarAndrew Collins <bsderandrew@gmail.com>
Acked-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c6f40899

net/ipv4/netfilter/iptable_nat.c

+10 −5
Original line number Diff line number Diff line
@@ -124,23 +124,28 @@ nf_nat_ipv4_fn(unsigned int hooknum, 
			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);

			if (ret != NF_ACCEPT)

				return ret;

		} else

		} else {

			pr_debug("Already setup manip %s for ct %p\n",

				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",

				 ct);

			if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))

				goto oif_changed;

		}

		break;



	default:

		/* ESTABLISHED */

		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||

			     ctinfo == IP_CT_ESTABLISHED_REPLY);

		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) {

			nf_ct_kill_acct(ct, ctinfo, skb);

			return NF_DROP;

		}

		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))

			goto oif_changed;

	}



	return nf_nat_packet(ct, ctinfo, hooknum, skb);



oif_changed:

	nf_ct_kill_acct(ct, ctinfo, skb);

	return NF_DROP;

}



static unsigned int

net/ipv6/netfilter/ip6table_nat.c

+10 −5
Original line number Diff line number Diff line
@@ -127,23 +127,28 @@ nf_nat_ipv6_fn(unsigned int hooknum, 
			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);

			if (ret != NF_ACCEPT)

				return ret;

		} else

		} else {

			pr_debug("Already setup manip %s for ct %p\n",

				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",

				 ct);

			if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))

				goto oif_changed;

		}

		break;



	default:

		/* ESTABLISHED */

		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||

			     ctinfo == IP_CT_ESTABLISHED_REPLY);

		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) {

			nf_ct_kill_acct(ct, ctinfo, skb);

			return NF_DROP;

		}

		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))

			goto oif_changed;

	}



	return nf_nat_packet(ct, ctinfo, hooknum, skb);



oif_changed:

	nf_ct_kill_acct(ct, ctinfo, skb);

	return NF_DROP;

}



static unsigned int

CRA Git | Maintained and supported by SUSTech CRA and CCSE