# This is a BitKeeper generated diff -Nru style patch. # # ChangeSet # 2004/12/05 22:15:40+01:00 kaber@coreworks.de # [NETFILTER]: Apply PRE_ROUTING manips in LOCAL_OUT for locally generated icmp errors # # Locally generated ICMP errors never hit PRE_ROUTING. Fixes invalid # addressed ICMP errors for SNATed packets. # # Signed-off-by: Patrick McHardy # # net/ipv4/netfilter/ip_nat_core.c # 2004/12/05 22:15:39+01:00 kaber@coreworks.de +8 -0 # [NETFILTER]: Apply PRE_ROUTING manips in LOCAL_OUT for locally generated icmp errors # # Locally generated ICMP errors never hit PRE_ROUTING. Fixes invalid # addressed ICMP errors for SNATed packets. # # Signed-off-by: Patrick McHardy # diff -Nru a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c --- a/net/ipv4/netfilter/ip_nat_core.c 2004-12-20 06:59:28 +01:00 +++ b/net/ipv4/netfilter/ip_nat_core.c 2004-12-20 06:59:28 +01:00 @@ -918,6 +918,14 @@ /* Mapping the inner packet is just like a normal packet, except * it was never src/dst reversed, so where we would normally * apply a dst manip, we apply a src, and vice versa. */ + + /* Only true for forwarded packets, locally generated packets + * never hit PRE_ROUTING, we need to apply their PRE_ROUTING + * manips in LOCAL_OUT. */ + if (hooknum == NF_IP_LOCAL_OUT && + info->manips[i].hooknum == NF_IP_PRE_ROUTING) + hooknum = info->manips[i].hooknum; + if (info->manips[i].hooknum != hooknum) continue;