Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d244121 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: nf_nat_sip: fix NAT setup order 



We need to set up the destination NAT mapping before the source NAT
mapping, so the NAT core gets to see the final tuple and can decide
whether the source port needs to be remapped.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b8beedd2

net/ipv4/netfilter/nf_nat_sip.c

+6 −6
Original line number Diff line number Diff line
@@ -224,17 +224,17 @@ static void ip_nat_sdp_expect(struct nf_conn *ct, 
	/* This must be a fresh one. */

	BUG_ON(ct->status & IPS_NAT_DONE_MASK);



	/* Change src to where master sends to */

	range.flags = IP_NAT_RANGE_MAP_IPS;

	range.min_ip = range.max_ip

		= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;

	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);



	/* For DST manip, map port here to where it's expected. */

	range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);

	range.min = range.max = exp->saved_proto;

	range.min_ip = range.max_ip = exp->saved_ip;

	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);



	/* Change src to where master sends to */

	range.flags = IP_NAT_RANGE_MAP_IPS;

	range.min_ip = range.max_ip

		= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;

	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);

}



/* So, this packet has hit the connection tracking matching code.