Hi all:
In function nf_nat_setup_info, we need to get the current tuple
which is supposed to send to destination.
If we haven't done any NAT (SNAT or DNAT) for the tuple, then the
current tuple is equal to original tuple,
otherwise, we should get current tuple by invoking
nf_ct_invert_tuplepr(curr_tuple, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
like the existing comment says:
/* What we've got will look like inverse of reply. Normally
* this is what is in the conntrack, except for prior
* manipulations (future optimization: if num_manips == 0,
* orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
*/
nf_ct_invert_tuplepr(&curr_tuple,
&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
So, since it is so, why don't we do the optimization for getting
current tuple ?
As mentioned above, if we have not done DNAT for the tuple, then the
current tuple is equal to original tuple.
So I add the optimization as following:
+ if (!(ct->status & IPS_DST_NAT)) /* we do the optimization, as
mentioned above */
+ curr_tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ else
+ nf_ct_invert_tuplepr(curr_tuple,
&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
the attachment is the detailed diff.
Attachment:
do the optimization for getting curr_tuple in function nf_nat_setup_info.diff
Description: Binary data
