[ipfilter-cvs] ipfilter ip_nat.c, v5-1-RELEASE ip_nat.h, v5-1-RELEASE ip_nat6.c, v5-1-RELEASE
Brought to you by:
darren_r
From: Darren <dar...@us...> - 2012-08-25 14:53:49
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26310 Modified Files: Tag: v5-1-RELEASE ip_nat.c ip_nat.h ip_nat6.c Log Message: 3561248 nat rules with icmpid do not work as advertised Index: ip_nat6.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat6.c,v retrieving revision 1.22.2.21 retrieving revision 1.22.2.22 diff -C2 -d -r1.22.2.21 -r1.22.2.22 *** ip_nat6.c 13 Aug 2012 11:44:15 -0000 1.22.2.21 --- ip_nat6.c 25 Aug 2012 14:53:46 -0000 1.22.2.22 *************** *** 332,337 **** n->in_use--; } ! ! /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_delmap */ --- 332,337 ---- n->in_use--; } ! ! /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_delmap */ *************** *** 672,676 **** } ! if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) port = sport; --- 672,676 ---- } ! if ((port == 0) && (flags & IPN_TCPUDPICMP)) port = sport; *************** *** 1976,1980 **** } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_osport != dport) { continue; } --- 1976,1980 ---- } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_oicmpid != dport) { continue; } *************** *** 1994,1998 **** } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_osport != dport) { continue; } --- 1994,1998 ---- } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_nicmpid != dport) { continue; } *************** *** 2290,2294 **** } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_osport != dport) { continue; } --- 2290,2294 ---- } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_nicmpid != dport) { continue; } *************** *** 2309,2313 **** } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_osport != dport) { continue; } --- 2309,2313 ---- } else if (p == IPPROTO_ICMPV6) { ! if (nat->nat_oicmpid != dport) { continue; } *************** *** 2932,2938 **** } ! if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) { icmp6 = fin->fin_dp; ! icmp6->icmp6_id = nat->nat_nicmpid; } --- 2932,2947 ---- } ! if ((nat->nat_nicmpid != 0) && (nflags & IPN_ICMPQUERY)) { icmp6 = fin->fin_dp; ! ! switch (nat->nat_dir) ! { ! case NAT_OUTBOUND : ! icmp6->icmp6_id = nat->nat_nicmpid; ! break; ! case NAT_INBOUND : ! icmp6->icmp6_id = nat->nat_oicmpid; ! break; ! } } *************** *** 3357,3364 **** ! if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) { icmp6 = fin->fin_dp; ! icmp6->icmp6_id = nat->nat_nicmpid; } --- 3366,3381 ---- ! if ((nat->nat_nicmpid != 0) && (nflags & IPN_ICMPQUERY)) { icmp6 = fin->fin_dp; ! switch (nat->nat_dir) ! { ! case NAT_INBOUND : ! icmp6->icmp6_id = nat->nat_nicmpid; ! break; ! case NAT_OUTBOUND : ! icmp6->icmp6_id = nat->nat_oicmpid; ! break; ! } } Index: ip_nat.h =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.h,v retrieving revision 1.18.2.13 retrieving revision 1.18.2.14 diff -C2 -d -r1.18.2.13 -r1.18.2.14 *** ip_nat.h 22 Jul 2012 08:04:23 -0000 1.18.2.13 --- ip_nat.h 25 Aug 2012 14:53:46 -0000 1.18.2.14 *************** *** 342,348 **** #define IPN_TCPUDP (IPN_TCP|IPN_UDP) #define IPN_ICMPERR 0x00004 ! #define IPN_TCPUDPICMP (IPN_TCP|IPN_UDP|IPN_ICMPERR) #define IPN_ICMPQUERY 0x00008 - #define IPN_TCPUDPICMPQ (IPN_TCP|IPN_UDP|IPN_ICMPQUERY) #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR) #define IPN_AUTOPORTMAP 0x00010 --- 342,347 ---- #define IPN_TCPUDP (IPN_TCP|IPN_UDP) #define IPN_ICMPERR 0x00004 ! #define IPN_TCPUDPICMP (IPN_TCP|IPN_UDP|IPN_ICMPQUERY) #define IPN_ICMPQUERY 0x00008 #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR) #define IPN_AUTOPORTMAP 0x00010 Index: ip_nat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.c,v retrieving revision 1.60.2.41 retrieving revision 1.60.2.42 diff -C2 -d -r1.60.2.41 -r1.60.2.42 *** ip_nat.c 13 Aug 2012 11:44:15 -0000 1.60.2.41 --- ip_nat.c 25 Aug 2012 14:53:46 -0000 1.60.2.42 *************** *** 2821,2825 **** } ! if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) port = sport; --- 2821,2825 ---- } ! if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPERR))) port = sport; *************** *** 4157,4161 **** } else if (p == IPPROTO_ICMP) { ! if (nat->nat_osport != dport) { continue; } --- 4157,4161 ---- } else if (p == IPPROTO_ICMP) { ! if (nat->nat_oicmpid != dport) { continue; } *************** *** 4183,4187 **** } else if (p == IPPROTO_ICMP) { ! if (nat->nat_osport != dport) { continue; } --- 4183,4187 ---- } else if (p == IPPROTO_ICMP) { ! if (nat->nat_nicmpid != dport) { continue; } *************** *** 4488,4492 **** } else if (p == IPPROTO_ICMP) { ! if (nat->nat_osport != dport) { continue; } --- 4488,4492 ---- } else if (p == IPPROTO_ICMP) { ! if (nat->nat_nicmpid != dport) { continue; } *************** *** 4508,4512 **** } else if (p == IPPROTO_ICMP) { ! if (nat->nat_osport != dport) { continue; } --- 4508,4512 ---- } else if (p == IPPROTO_ICMP) { ! if (nat->nat_oicmpid != dport) { continue; } *************** *** 5275,5281 **** } ! if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) { icmp = fin->fin_dp; ! icmp->icmp_id = nat->nat_nicmpid; } --- 5275,5291 ---- } ! ! if ((nat->nat_oicmpid != 0) && (nflags & IPN_ICMPQUERY)) { icmp = fin->fin_dp; ! ! switch (nat->nat_dir) ! { ! case NAT_OUTBOUND : ! icmp->icmp_id = nat->nat_nicmpid; ! break; ! case NAT_INBOUND : ! icmp->icmp_id = nat->nat_oicmpid; ! break; ! } } *************** *** 5749,5756 **** ! if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) { icmp = fin->fin_dp; ! icmp->icmp_id = nat->nat_nicmpid; } --- 5759,5774 ---- ! if ((nat->nat_oicmpid != 0) && (nflags & IPN_ICMPQUERY)) { icmp = fin->fin_dp; ! switch (nat->nat_dir) ! { ! case NAT_INBOUND : ! icmp->icmp_id = nat->nat_nicmpid; ! break; ! case NAT_OUTBOUND : ! icmp->icmp_id = nat->nat_oicmpid; ! break; ! } } |