netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario

Browse source

We use the reply tuples when limiting the connections by the destination
addresses, however, in SNAT scenario, the final reply tuples won't be
ready until SNAT is done in POSTROUING or INPUT chain, and the following
nf_conntrack_find_get() in count_tem() will get nothing, so connlimit
can't work as expected.

In this patch, the original tuples are always used, and an additional
member addr is appended to save the address in either end.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

...

This commit is contained in:

Changli Gao 2011-03-15 13:23:28 +01:00 • committed by Patrick McHardy

parent f2247fbdc4

commit 8183e3a88a

1 changed files with 9 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

20

net/netfilter/xt_connlimit.c

View file