nf_nat: dont check for port change on ICMP tuples

PATCH New Ulrich Weber 1 participant 1 message Aug 31, 2011

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Ulrich Weber

author

2011-08-31 12:20 UTC #0 lore raw

PATCH 1/1 nf_nat: dont check for port change on ICMP tuples

ICMP tuples have id in src and type/code in dst. So comparing src.u.all with dst.u.all will always fail here and ip_xfrm_me_harder() is called for every ICMP packet, even if there was no NAT...

Signed-off-by Ulrich Weber <[email protected]>

---
 net/ipv4/netfilter/nf_nat_standalone.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

net/ipv4/netfilter/nf_nat_standalone.c +4 -2

index 9290048..e32b542 100644
@@ -194,7 +194,8 @@ nf_nat_out(unsigned int hooknum,
 
 		if ((ct->tuplehash[dir].tuple.src.u3.ip !=
 		     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
-		    (ct->tuplehash[dir].tuple.src.u.all !=
+		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+		     ct->tuplehash[dir].tuple.src.u.all !=
 		     ct->tuplehash[!dir].tuple.dst.u.all)
 		   )
 			return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;

@@ -230,7 +231,8 @@ nf_nat_local_fn(unsigned int hooknum,
 				ret = NF_DROP;
 		}
 #ifdef CONFIG_XFRM
-		else if (ct->tuplehash[dir].tuple.dst.u.all !=
+		else if (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+			 ct->tuplehash[dir].tuple.dst.u.all !=
 			 ct->tuplehash[!dir].tuple.src.u.all)
 			if (ip_xfrm_me_harder(skb))
 				ret = NF_DROP;

Signature · 1 line

1.7.4.1