On 26.01.2011 13:07, Jan Engelhardt wrote:
>
>
> The following changes since commit 4b3fd57138c969dd940651fadf90db627254edbf:
>
> IPVS: Change sock_create_kernel() to __sock_create() (2011-01-22 13:48:01 +1100)
>
> are available in the git repository at:
> git://dev.medozas.de/linux connlimit
>
> Jan Engelhardt (1):
> netfilter: xt_connlimit: pick right dstaddr in NAT scenario
>
> net/netfilter/xt_connlimit.c | 12 ++++++++----
> 1 files changed, 8 insertions(+), 4 deletions(-)
>
> ===
>
> parent 4b3fd57138c969dd940651fadf90db627254edbf (v2.6.38-rc1-151-g4b3fd57)
> commit ad86e1f27a9a97a9e50810b10bca678407b1d6fd
> Author: Jan Engelhardt <jengelh@xxxxxxxxxx>
> Date: Wed Jan 26 11:50:03 2011 +0100
>
> netfilter: xt_connlimit: pick right dstaddr in NAT scenario
>
> xt_connlimit normally records the "original" tuples in a hashlist
> (such as "1.2.3.4 -> 5.6.7.8"), and looks in this list for iph->daddr
> when counting.
>
> When the user however uses DNAT in PREROUTING, looking for
> iph->daddr -- which is now 192.168.9.10 -- will not match. Thus in
> daddr mode, we need to record the reverse direction tuple
> ("192.168.9.10 -> 1.2.3.4") instead. In the reverse tuple, the dst
> addr is on the src side, which is convenient, as count_them still uses
> &conn->tuple.src.u3.
>
Pulled, thanks Jan.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
