From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH resend] netfilter: place in source hash after SNAT is done Date: Tue, 18 Jan 2011 15:17:22 +0100 Message-ID: <4D35A0F2.5010908@trash.net> References: <1295090930-16671-1-git-send-email-xiaosuo@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: "David S. Miller" , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org To: Changli Gao Return-path: In-Reply-To: <1295090930-16671-1-git-send-email-xiaosuo@gmail.com> Sender: netdev-owner@vger.kernel.org List-Id: netfilter-devel.vger.kernel.org On 15.01.2011 12:28, Changli Gao wrote: > If SNAT isn't done, the wrong info maybe got by the other cts. > > As the filter table is after DNAT table, the packets dropped in filter > table also bother bysource hash table. > > Signed-off-by: Changli Gao > --- > net/ipv4/netfilter/nf_nat_core.c | 18 +++++++++++------- > 1 file changed, 11 insertions(+), 7 deletions(-) > diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c > index c04787c..51ce55a 100644 > --- a/net/ipv4/netfilter/nf_nat_core.c > +++ b/net/ipv4/netfilter/nf_nat_core.c > @@ -221,7 +221,14 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, > manips not an issue. */ > if (maniptype == IP_NAT_MANIP_SRC && > !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) { > - if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) { > + /* try the original tuple first */ This doesn't seem to be related to the hashing change. Please describe the intention behind this change. > + if (in_range(orig_tuple, range)) { > + if (!nf_nat_used_tuple(orig_tuple, ct)) { > + *tuple = *orig_tuple; > + return; > + } > + } else if (find_appropriate_src(net, zone, orig_tuple, tuple, > + range)) { > pr_debug("get_unique_tuple: Found current src map\n"); > if (!nf_nat_used_tuple(tuple, ct)) > return;