[NETFILTER]: get_unique_tuple doesn't always return unique tuple.

get_unique_tuple doesn't check that the tuple is unique if it finds
a hash_by_src match.

diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index a6a427dbbe272d64f7b92ad01a9d7cf9842bec48..04714407965e1d479f2fc7559f706e471956bd37 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -421,7 +421,8 @@ get_unique_tuple(struct ip_conntrack_tuple *tuple,
                        *tuple = ((struct ip_conntrack_tuple)
                                  { *manip, orig_tuple->dst });
                        DEBUGP("get_unique_tuple: Found current src map\n");
-                       return 1;
+                       if (!ip_nat_used_tuple(tuple, conntrack))
+                               return 1;
                }
        }