Commit 1bf453b3 authored by Harald Welte's avatar Harald Welte Committed by David S. Miller

[NETFILTER]: fix NAT ICMP reply translation of inner packet.

parent 1b31fcf3
...@@ -913,7 +913,7 @@ icmp_reply_translation(struct sk_buff *skb, ...@@ -913,7 +913,7 @@ icmp_reply_translation(struct sk_buff *skb,
packet, except it was never src/dst reversed, so packet, except it was never src/dst reversed, so
where we would normally apply a dst manip, we apply where we would normally apply a dst manip, we apply
a src, and vice versa. */ a src, and vice versa. */
if (info->manips[i].hooknum == opposite_hook[hooknum]) { if (info->manips[i].hooknum == hooknum) {
DEBUGP("icmp_reply: inner %s -> %u.%u.%u.%u %u\n", DEBUGP("icmp_reply: inner %s -> %u.%u.%u.%u %u\n",
info->manips[i].maniptype == IP_NAT_MANIP_SRC info->manips[i].maniptype == IP_NAT_MANIP_SRC
? "DST" : "SRC", ? "DST" : "SRC",
...@@ -926,7 +926,7 @@ icmp_reply_translation(struct sk_buff *skb, ...@@ -926,7 +926,7 @@ icmp_reply_translation(struct sk_buff *skb,
&skb->nfcache); &skb->nfcache);
/* Outer packet needs to have IP header NATed like /* Outer packet needs to have IP header NATed like
it's a reply. */ it's a reply. */
} else if (info->manips[i].hooknum == hooknum) {
/* Use mapping to map outer packet: 0 give no /* Use mapping to map outer packet: 0 give no
per-proto mapping */ per-proto mapping */
DEBUGP("icmp_reply: outer %s -> %u.%u.%u.%u\n", DEBUGP("icmp_reply: outer %s -> %u.%u.%u.%u\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment