[RFC PATCH 1/1] netfilter: nat: restore default DNAT behavior

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


When a DNAT rule is configured via iptables with different port ranges,

iptables -t nat -A PREROUTING -p tcp -d -m tcp --dport 32000:32010
-j DNAT --to-destination

we seem to be DNATing to some random port on the LAN side. While this is
expected if --random is passed to the iptables command, it is not
expected without passing --random.  The expected behavior (and the
observed behavior in v4.4) is the traffic will be DNAT'd to unless there is a tuple collision with that
destination.  In that case, we expect the traffic to be instead DNAT'd
to, so on so forth until the end of the range.

This patch is a naive attempt to restore the behavior seen in v4.4.  I'm
hopeful folks will point out problems and regressions this could cause
elsewhere, since I've little experience in the net tree.

Signed-off-by: Kyle Swenson <kyle.swenson@xxxxxxxx>
 net/netfilter/nf_nat_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index c3d7ecbc777c..bd275c3906f7 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -549,12 +549,14 @@ static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple,
 	if (range->flags & NF_NAT_RANGE_PROTO_OFFSET)
 		off = (ntohs(*keyptr) - ntohs(range->base_proto.all));
-	else
+	else if (range->flags & NF_NAT_RANGE_PROTO_RANDOM)
 		off = get_random_u16();
+	else
+		off = 0;
 	attempts = range_size;
 	if (attempts > NF_NAT_MAX_ATTEMPTS)
 		attempts = NF_NAT_MAX_ATTEMPTS;

[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux