diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2008-09-16 21:11:37 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2008-09-16 21:11:37 +0200 |
| commit | 587a85e0603d514656a434d44c82d1fdacd5e326 (patch) | |
| tree | 69df265143a342ca59c2cde27c4472a5a5db0a0b | |
| parent | 406737e5aa38f90b01aebe2f6295e7b4ef828220 (diff) | |
filter: fix NAT detection tweak
With this patch, we rely on the real source and destination of the
packet to perform the filter. The current NAT detection tweak is broken
for certain situations.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/filter.c | 9 | ||||
| -rw-r--r-- | src/netlink.c | 12 |
2 files changed, 3 insertions, 18 deletions
diff --git a/src/filter.c b/src/filter.c index eaf0a93..33fe30e 100644 --- a/src/filter.c +++ b/src/filter.c @@ -167,10 +167,9 @@ __ct_filter_test_ipv4(struct ct_filter *f, struct nf_conntrack *ct) if (!f->h) return 0; + /* we only use the real source and destination address */ return (hashtable_test(f->h, nfct_get_attr(ct, ATTR_ORIG_IPV4_SRC)) || - hashtable_test(f->h, nfct_get_attr(ct, ATTR_ORIG_IPV4_DST)) || - hashtable_test(f->h, nfct_get_attr(ct, ATTR_REPL_IPV4_SRC)) || - hashtable_test(f->h, nfct_get_attr(ct, ATTR_REPL_IPV4_DST))); + hashtable_test(f->h, nfct_get_attr(ct, ATTR_REPL_IPV4_SRC))); } static int @@ -180,9 +179,7 @@ __ct_filter_test_ipv6(struct ct_filter *f, struct nf_conntrack *ct) return 0; return (hashtable_test(f->h6, nfct_get_attr(ct, ATTR_ORIG_IPV6_SRC)) || - hashtable_test(f->h6, nfct_get_attr(ct, ATTR_ORIG_IPV6_DST)) || - hashtable_test(f->h6, nfct_get_attr(ct, ATTR_REPL_IPV6_SRC)) || - hashtable_test(f->h6, nfct_get_attr(ct, ATTR_REPL_IPV6_DST))); + hashtable_test(f->h6, nfct_get_attr(ct, ATTR_REPL_IPV6_SRC))); } static int __ct_filter_test_state(struct ct_filter *f, struct nf_conntrack *ct) diff --git a/src/netlink.c b/src/netlink.c index 8b02ac5..a4b94dd 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -66,18 +66,6 @@ int ignore_conntrack(struct nf_conntrack *ct) if (!sanity_check(ct)) return 1; - /* Accept DNAT'ed traffic: not really coming to the local machine */ - if (nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT)) { - debug_ct(ct, "DNAT"); - return 0; - } - - /* Accept SNAT'ed traffic: not really coming to the local machine */ - if (nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT)) { - debug_ct(ct, "SNAT"); - return 0; - } - /* Ignore traffic */ if (!ct_filter_check(STATE(us_filter), ct)) { debug_ct(ct, "ignore traffic"); |