summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2010-06-17 03:38:30 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2010-06-17 03:38:30 +0200
commit2e06d62d341fdf936dbc1fa944d5e03f761aaf0e (patch)
tree32b7f773e78e024e30c31b16328205455b743514
parentd72d89846eecb156279d9c66740f8e022a126cae (diff)
conntrack: fix `conntrack -L --src-nat --dst-nat' (second try)
This patch fixes the filtering with --src-nat and --dst-nat options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/conntrack.c22
1 files changed, 9 insertions, 13 deletions
diff --git a/src/conntrack.c b/src/conntrack.c
index eec3868..706fe50 100644
--- a/src/conntrack.c
+++ b/src/conntrack.c
@@ -635,27 +635,23 @@ filter_nat(const struct nf_conntrack *obj, const struct nf_conntrack *ct)
uint32_t ip;
if (options & CT_OPT_SRC_NAT) {
- if (!nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT))
- return 1;
-
if (nfct_attr_is_set(obj, ATTR_SNAT_IPV4)) {
ip = nfct_get_attr_u32(obj, ATTR_SNAT_IPV4);
- if (ip != nfct_get_attr_u32(ct, ATTR_REPL_IPV4_DST))
- return 1;
- }
+ if (ip == nfct_get_attr_u32(ct, ATTR_REPL_IPV4_DST))
+ return 0;
+ } else if (nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT))
+ return 0;
}
if (options & CT_OPT_DST_NAT) {
- if (!nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT))
- return 1;
-
if (nfct_attr_is_set(obj, ATTR_DNAT_IPV4)) {
ip = nfct_get_attr_u32(obj, ATTR_DNAT_IPV4);
- if (ip != nfct_get_attr_u32(ct, ATTR_REPL_IPV4_SRC))
- return 1;
- }
+ if (ip == nfct_get_attr_u32(ct, ATTR_REPL_IPV4_SRC))
+ return 0;
+ } else if (nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT))
+ return 0;
}
- return 0;
+ return (options & (CT_OPT_SRC_NAT | CT_OPT_DST_NAT)) ? 1 : 0;
}
static int counter;