nf_nat: restrict ICMP translation for embedded header

Browse source

Skip ICMP translation of embedded protocol header
if NAT bits are not set. Needed for IPVS to see the original
embedded addresses because for IPVS traffic the IPS_SRC_NAT_BIT
and IPS_DST_NAT_BIT bits are not set. It happens when IPVS performs
DNAT for client packets after using nf_conntrack_alter_reply
to expect replies from real server.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>

...

This commit is contained in:

Julian Anastasov 2010-10-11 11:23:07 +03:00 • committed by Simon Horman

parent 0d79641a96

commit b0aeef3043

1 changed files with 15 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

29

net/ipv4/netfilter/nf_nat_core.c

View file