From: Xiaoping Fan <xfan@xxxxxxxxxxxxxx> In some case, bridged packet will come back again for routing. When bridge netfilter is enabled, a null snat rule is assigned to bridged packet if no matching in nat chain. Then nat rule matching is skipped when packet comes back for routing. This result in private IP address exported to public network. So we don't assign a null snat rule to bridged traffic if no matching. Signed-off-by: Xiaoping Fan <xfan@xxxxxxxxxxxxxx> --- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 3 +++ net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c index 41c7992..151eee6 100644 --- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c @@ -315,6 +315,9 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, break; } + if (nf_nat_is_bridged_pkt(skb)) + break; + ret = nf_nat_alloc_null_binding(ct, state->hook); if (ret != NF_ACCEPT) return ret; diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c index dc8df3a..c94eae4 100644 --- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c @@ -324,6 +324,9 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb, break; } + if (nf_nat_is_bridged_pkt(skb)) + break; + ret = nf_nat_alloc_null_binding(ct, state->hook); if (ret != NF_ACCEPT) return ret; -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
