From patchwork Mon Nov 15 04:48:03 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Changli Gao X-Patchwork-Id: 71175 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2171FB7113 for ; Mon, 15 Nov 2010 15:48:38 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757482Ab0KOEs3 (ORCPT ); Sun, 14 Nov 2010 23:48:29 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:53778 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757331Ab0KOEs2 (ORCPT ); Sun, 14 Nov 2010 23:48:28 -0500 Received: by ywc21 with SMTP id 21so1508728ywc.19 for ; Sun, 14 Nov 2010 20:48:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:subject:date :message-id:x-mailer; bh=YRubQalq8BvPc6lG4kR6iDBC7HI2Bw3hHdGdWp2t5pg=; b=wEDXha4X6uY0CTs1SCl1k296KNWc0KxIeC3hl9wArzcDQOIZo++LyfUTAhi0TvE1eX iWmDuvKzzVuVU9kg4gy/RjV08j4x5wD3HUzl6tGtZ2WPNwq1FVPH9Tz3TJh6zRTafrvX WeTnIpDvyiW5Y4CAucdAEKFSJdEkzLzXo6e6Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=obpPNGWDBeN9EFMd6RZDT74A/IUMt9lMwCjKyyJpKbSr9vTGUCPTpn4Ytcj8Fhfvua sUp+ozvGrVHbPL+J/MmXZ6YFMeJVna5R65ztaz2TEfhQSi+VCwWacATEJjxga/CNEiOE iNBV0haesYd5nCf0OAAuA3ALVa9A76rXkXpBI= Received: by 10.150.202.11 with SMTP id z11mr8637371ybf.207.1289796506967; Sun, 14 Nov 2010 20:48:26 -0800 (PST) Received: from localhost.localdomain ([221.239.34.230]) by mx.google.com with ESMTPS id v12sm2829611ybk.23.2010.11.14.20.48.18 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sun, 14 Nov 2010 20:48:25 -0800 (PST) From: Changli Gao To: Patrick McHardy Cc: "David S. Miller" , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Changli Gao Subject: [PATCH] netfilter: place in source hash after SNAT is done Date: Mon, 15 Nov 2010 12:48:03 +0800 Message-Id: <1289796483-2970-1-git-send-email-xiaosuo@gmail.com> X-Mailer: git-send-email 1.7.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If SNAT isn't done, the wrong info maybe got by the other cts. As the filter table is after DNAT table, the packets dropped in filter table also bother bysource hash table. Signed-off-by: Changli Gao --- net/ipv4/netfilter/nf_nat_core.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c index c04787c..51ce55a 100644 --- a/net/ipv4/netfilter/nf_nat_core.c +++ b/net/ipv4/netfilter/nf_nat_core.c @@ -221,7 +221,14 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, manips not an issue. */ if (maniptype == IP_NAT_MANIP_SRC && !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) { - if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) { + /* try the original tuple first */ + if (in_range(orig_tuple, range)) { + if (!nf_nat_used_tuple(orig_tuple, ct)) { + *tuple = *orig_tuple; + return; + } + } else if (find_appropriate_src(net, zone, orig_tuple, tuple, + range)) { pr_debug("get_unique_tuple: Found current src map\n"); if (!nf_nat_used_tuple(tuple, ct)) return; @@ -266,7 +273,6 @@ nf_nat_setup_info(struct nf_conn *ct, struct net *net = nf_ct_net(ct); struct nf_conntrack_tuple curr_tuple, new_tuple; struct nf_conn_nat *nat; - int have_to_hash = !(ct->status & IPS_NAT_DONE_MASK); /* nat helper or nfctnetlink also setup binding */ nat = nfct_nat(ct); @@ -306,8 +312,7 @@ nf_nat_setup_info(struct nf_conn *ct, ct->status |= IPS_DST_NAT; } - /* Place in source hash if this is the first time. */ - if (have_to_hash) { + if (maniptype == IP_NAT_MANIP_SRC) { unsigned int srchash; srchash = hash_by_src(net, nf_ct_zone(ct), @@ -532,7 +537,7 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct) if (nat == NULL || nat->ct == NULL) return; - NF_CT_ASSERT(nat->ct->status & IPS_NAT_DONE_MASK); + NF_CT_ASSERT(nat->ct->status & IPS_SRC_NAT_DONE); spin_lock_bh(&nf_nat_lock); hlist_del_rcu(&nat->bysource); @@ -545,11 +550,10 @@ static void nf_nat_move_storage(void *new, void *old) struct nf_conn_nat *old_nat = old; struct nf_conn *ct = old_nat->ct; - if (!ct || !(ct->status & IPS_NAT_DONE_MASK)) + if (!ct || !(ct->status & IPS_SRC_NAT_DONE)) return; spin_lock_bh(&nf_nat_lock); - new_nat->ct = ct; hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource); spin_unlock_bh(&nf_nat_lock); }