mirror of
https://github.com/torvalds/linux.git
synced 2024-12-11 05:33:09 +00:00
netfilter: nf_nat: Handle routing changes in MASQUERADE target
When the route changes (backup default route, VPNs) which affect a masqueraded target, the packets were sent out with the outdated source address. The patch addresses the issue by comparing the outgoing interface directly with the masqueraded interface in the nat table. Events are inefficient in this case, because it'd require adding route events to the network core and then scanning the whole conntrack table and re-checking the route for all entry. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
6d1fafcaec
commit
a0ecb85a2c
@ -68,4 +68,19 @@ static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
|
|||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline bool nf_nat_oif_changed(unsigned int hooknum,
|
||||||
|
enum ip_conntrack_info ctinfo,
|
||||||
|
struct nf_conn_nat *nat,
|
||||||
|
const struct net_device *out)
|
||||||
|
{
|
||||||
|
#if IS_ENABLED(CONFIG_IP_NF_TARGET_MASQUERADE) || \
|
||||||
|
IS_ENABLED(CONFIG_IP6_NF_TARGET_MASQUERADE)
|
||||||
|
return nat->masq_index && hooknum == NF_INET_POST_ROUTING &&
|
||||||
|
CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL &&
|
||||||
|
nat->masq_index != out->ifindex;
|
||||||
|
#else
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
@ -134,6 +134,10 @@ nf_nat_ipv4_fn(unsigned int hooknum,
|
|||||||
/* ESTABLISHED */
|
/* ESTABLISHED */
|
||||||
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
|
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
|
||||||
ctinfo == IP_CT_ESTABLISHED_REPLY);
|
ctinfo == IP_CT_ESTABLISHED_REPLY);
|
||||||
|
if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) {
|
||||||
|
nf_ct_kill_acct(ct, ctinfo, skb);
|
||||||
|
return NF_DROP;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return nf_nat_packet(ct, ctinfo, hooknum, skb);
|
return nf_nat_packet(ct, ctinfo, hooknum, skb);
|
||||||
|
@ -137,6 +137,10 @@ nf_nat_ipv6_fn(unsigned int hooknum,
|
|||||||
/* ESTABLISHED */
|
/* ESTABLISHED */
|
||||||
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
|
NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
|
||||||
ctinfo == IP_CT_ESTABLISHED_REPLY);
|
ctinfo == IP_CT_ESTABLISHED_REPLY);
|
||||||
|
if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) {
|
||||||
|
nf_ct_kill_acct(ct, ctinfo, skb);
|
||||||
|
return NF_DROP;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return nf_nat_packet(ct, ctinfo, hooknum, skb);
|
return nf_nat_packet(ct, ctinfo, hooknum, skb);
|
||||||
|
Loading…
Reference in New Issue
Block a user