Commit ad86e1f2 authored Jan 26, 2011 by Jan Engelhardt

netfilter: xt_connlimit: pick right dstaddr in NAT scenario



xt_connlimit normally records the "original" tuples in a hashlist
(such as "1.2.3.4 -> 5.6.7.8"), and looks in this list for iph->daddr
when counting.

When the user however uses DNAT in PREROUTING, looking for
iph->daddr -- which is now 192.168.9.10 -- will not match. Thus in
daddr mode, we need to record the reverse direction tuple
("192.168.9.10 -> 1.2.3.4") instead. In the reverse tuple, the dst
addr is on the src side, which is convenient, as count_them still uses
&conn->tuple.src.u3.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

parent 4b3fd571

net/netfilter/xt_connlimit.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -185,11 +185,15 @@ connlimit_mt(const struct sk_buff skb, struct xt_action_param par)
		int connections;

		ct = nf_ct_get(skb, &ctinfo);
		if (ct != NULL)
		tuple_ptr = &ct->tuplehash[0].tuple;
		else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
		par->family, &tuple))
		if (ct != NULL) {
		if (info->flags & XT_CONNLIMIT_DADDR)
		tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
		else
		tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
		} else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
		par->family, &tuple)) {
		goto hotdrop;
		}

		if (par->family == NFPROTO_IPV6) {
		const struct ipv6hdr *iph = ipv6_hdr(skb);