UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario 

We use the reply tuples when limiting the connections by the destination
addresses, however, in SNAT scenario, the final reply tuples won't be
ready until SNAT is done in POSTROUING or INPUT chain, and the following
nf_conntrack_find_get() in count_tem() will get nothing, so connlimit
can't work as expected.

In this patch, the original tuples are always used, and an additional
member addr is appended to save the address in either end.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Changli Gao 2011-03-15 13:23:28 +01:00 committed by Patrick McHardy
parent f2247fbdc4
commit 8183e3a88a
1 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
net/netfilter/xt_connlimit.c
View File

@ -33,8 +33,9 @@
/* we will save the tuples of all connections we care about */ /* we will save the tuples of all connections we care about */
struct xt_connlimit_conn { struct xt_connlimit_conn {
struct list_head list; struct list_head list;
struct nf_conntrack_tuple tuple; struct nf_conntrack_tuple tuple;
union nf_inet_addr addr;
}; };
struct xt_connlimit_data { struct xt_connlimit_data {
@ -151,7 +152,7 @@ static int count_them(struct net *net,
continue; continue;
} }
if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) if (same_source_net(addr, mask, &conn->addr, family))
/* same source network -> be counted! */ /* same source network -> be counted! */
++matches; ++matches;
nf_ct_put(found_ct); nf_ct_put(found_ct);
@ -165,6 +166,7 @@ static int count_them(struct net *net,
if (conn == NULL) if (conn == NULL)
return -ENOMEM; return -ENOMEM;
conn->tuple = *tuple; conn->tuple = *tuple;
conn->addr = *addr;
list_add(&conn->list, hash); list_add(&conn->list, hash);
++matches; ++matches;
} }
@ -185,15 +187,11 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
int connections; int connections;
ct = nf_ct_get(skb, &ctinfo); ct = nf_ct_get(skb, &ctinfo);
if (ct != NULL) { if (ct != NULL)
if (info->flags & XT_CONNLIMIT_DADDR) tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
else par->family, &tuple))
tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
} else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
par->family, &tuple)) {
goto hotdrop; goto hotdrop;
}
if (par->family == NFPROTO_IPV6) { if (par->family == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb); const struct ipv6hdr *iph = ipv6_hdr(skb);