]> git.hungrycats.org Git - linux/commit
projects / linux / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4d34401) | patch
netfilter: nf_nat: don't check for port change on ICMP tuples
authorUlrich Weber <ulrich.weber@sophos.com>
Thu, 25 Oct 2012 05:34:45 +0000 (05:34 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 26 Nov 2012 20:14:20 +0000 (12:14 -0800)
commit9a406de3049374c0e480baca0ffafd9588c57959
treed2824923272dc699e3265f8c14dc22a1b589571atree | snapshot
parent4d3440149ead396a3955f08608e535aed0befbc4commit | diff
netfilter: nf_nat: don't check for port change on ICMP tuples

commit 38fe36a248ec3228f8e6507955d7ceb0432d2000 upstream.

ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.

Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/netfilter/nf_nat_standalone.c diff | blob | history
Linux kernels and configurations used by Zygo.