| commit | 42c1edd345c8412d96e7a362ee06feb7be73bb6c | |
| author | Julian Anastasov <ja@ssi.bg> | |
| Thu, 16 Jun 2011 15:29:22 +0000 (16 17:29 +0200) | ||
| committer | Patrick McHardy <kaber@trash.net> | |
| Thu, 16 Jun 2011 15:29:22 +0000 (16 17:29 +0200) | ||
| tree | 5b05b0324b8186fe8bc40ffced48c856b099547d | treesnapshot (tar.gz zip) |
| parent | 2c38de4c1f8da799bdca0e4bb40ca13f2174d3e8 | commitdiff |
netfilter: nf_nat: avoid double seq_adjust for loopback
Avoid double seq adjustment for loopback traffic
because it causes silent repetition of TCP data. One
example is passive FTP with DNAT rule and difference in the
length of IP addresses.
This patch adds check if packet is sent and
received via loopback device. As the same conntrack is
used both for outgoing and incoming direction, we restrict
seq adjustment to happen only in POSTROUTING.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Avoid double seq adjustment for loopback traffic
because it causes silent repetition of TCP data. One
example is passive FTP with DNAT rule and difference in the
length of IP addresses.
This patch adds check if packet is sent and
received via loopback device. As the same conntrack is
used both for outgoing and incoming direction, we restrict
seq adjustment to happen only in POSTROUTING.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Patrick McHardy <kaber@trash.net>
| include/net/netfilter/nf_conntrack.h | diffblobblamehistory | |
| net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | diffblobblamehistory |