Re: [PATCH nf] netfilter: nat: fix icmp id randomization

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Apr 09, 2019 at 02:45:20PM +0200, Florian Westphal wrote:
> Sven Auhagen reported that a 2nd ping request will fail if 'fully-random'
> mode is used.
> 
> Reason is that if no proto information is given, min/max are both 0,
> so we set the icmp id to 0 instead of chosing a random value between
> 0 and 65535.
> 
> Update test case as well to catch this, without fix this yields:
> [..]
> ERROR: cannot ping ns1 from ns2 with ip masquerade fully-random (attempt 2)
> ERROR: cannot ping ns1 from ns2 with ipv6 masquerade fully-random (attempt 2)
> 
> ... becaus 2nd ping clashes with existing 'id 0' icmp conntrack and gets
> dropped.

Applied, thanks Florian.



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux