From: Chris Wright <chrisw@osdl.org>
To: linux-kernel@vger.kernel.org, stable@kernel.org,
"David S. Miller" <davem@davemloft.net>
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org, akpm@osdl.org, alan@lxorguk.ukuu.org.uk,
Patrick McHardy <kaber@trash.net>,
Netfilter Development Mailinglist
<netfilter-devel@lists.netfilter.org>,
Chris Wright <chrisw@osdl.org>
Subject: [PATCH 07/11] [NETFILTER]: Fix DHCP + MASQUERADE problem
Date: Wed, 14 Sep 2005 18:03:50 -0700 [thread overview]
Message-ID: <20050915010407.117847000@localhost.localdomain> (raw)
In-Reply-To: 20050915010343.577985000@localhost.localdomain
[-- Attachment #1: netfilter-fix-dhcp-masquerade-problem.patch --]
[-- Type: text/plain, Size: 1464 bytes --]
-stable review patch. If anyone has any objections, please let us know.
------------------
In 2.6.13-rcX the MASQUERADE target was changed not to exclude local
packets for better source address consistency. This breaks DHCP clients
using UDP sockets when the DHCP requests are caught by a MASQUERADE rule
because the MASQUERADE target drops packets when no address is configured
on the outgoing interface. This patch makes it ignore packets with a
source address of 0.
Thanks to Rusty for this suggestion.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
net/ipv4/netfilter/ipt_MASQUERADE.c | 6 ++++++
1 files changed, 6 insertions(+)
Index: linux-2.6.13.y/net/ipv4/netfilter/ipt_MASQUERADE.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ linux-2.6.13.y/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -95,6 +95,12 @@ masquerade_target(struct sk_buff **pskb,
IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
|| ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+ /* Source address is 0.0.0.0 - locally generated packet that is
+ * probably not supposed to be masqueraded.
+ */
+ if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip == 0)
+ return NF_ACCEPT;
+
mr = targinfo;
rt = (struct rtable *)(*pskb)->dst;
newsrc = inet_select_addr(out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
--
next prev parent reply other threads:[~2005-09-15 1:07 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-09-15 1:03 [PATCH 00/11] -stable review Chris Wright
2005-09-15 1:03 ` [PATCH 01/11] [PATCH] lost fput in 32bit ioctl on x86-64 Chris Wright
2005-09-15 1:03 ` [PATCH 02/11] [PATCH] Lost sockfd_put() in routing_ioctl() Chris Wright
2005-09-15 1:03 ` [PATCH 03/11] [PATCH] forcedeth: Initialize link settings in every nv_open() Chris Wright
2005-09-15 1:03 ` [PATCH 04/11] hpt366: write the full 4 bytes of ROM address, not just low 1 byte Chris Wright
2005-09-15 2:18 ` David Lang
2005-09-15 2:26 ` Andrew Morton
2005-09-15 2:29 ` [PATCH 04/11] hpt366: write the full 4 bytes of ROM address,not " David Lang
2005-09-15 6:11 ` [PATCH 04/11] hpt366: write the full 4 bytes of ROM address, not " Chris Wright
2005-09-15 10:39 ` David Lang
2005-09-15 10:28 ` Martin Mares
2005-09-15 1:03 ` [PATCH 05/11] Sun GEM ethernet: enable and map PCI ROM properly Chris Wright
2005-09-15 1:03 ` [PATCH 06/11] [stable] [ROM 3/3] Sun HME: " Chris Wright
2005-09-15 1:03 ` Chris Wright [this message]
2005-09-15 1:03 ` [PATCH 08/11] jfs: jfs_delete_inode must call clear_inode Chris Wright
2005-09-15 1:03 ` [PATCH 09/11] [PATCH] Fix MPOL_F_VERIFY Chris Wright
2005-09-15 1:03 ` [PATCH 10/11] Fix up more strange byte writes to the PCI_ROM_ADDRESS config word Chris Wright
2005-09-15 1:03 ` [PATCH 11/11] USB: ftdi_sio: custom baud rate fix Chris Wright
2005-09-15 7:36 ` [PATCH 00/11] -stable review Alexander Nyberg
2005-09-15 20:04 ` Chris Wright
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050915010407.117847000@localhost.localdomain \
--to=chrisw@osdl.org \
--cc=akpm@osdl.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=chuckw@quantumlinux.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=kaber@trash.net \
--cc=linux-kernel@vger.kernel.org \
--cc=netfilter-devel@lists.netfilter.org \
--cc=rdunlap@xenotime.net \
--cc=stable@kernel.org \
--cc=torvalds@osdl.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox