netfilter: masquerade: don't flush all conntracks if only one address deleted on...
authorTan Hu <tan.hu@zte.com.cn>
Fri, 7 Sep 2018 08:33:33 +0000 (16:33 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 28 Sep 2018 12:28:26 +0000 (14:28 +0200)
commit097f95d319f817e651bd51f8846aced92a55a6a1
tree0ee53a38d23a3c3eb02be0b671359305335e10a9
parent9306425b70bf1284a037b7461222887aff48cf8d
netfilter: masquerade: don't flush all conntracks if only one address deleted on device

We configured iptables as below, which only allowed incoming data on
established connections:

iptables -t mangle -A PREROUTING -m state --state ESTABLISHED -j ACCEPT
iptables -t mangle -P PREROUTING DROP

When deleting a secondary address, current masquerade implements would
flush all conntracks on this device. All the established connections on
primary address also be deleted, then subsequent incoming data on the
connections would be dropped wrongly because it was identified as NEW
connection.

So when an address was delete, it should only flush connections related
with the address.

Signed-off-by: Tan Hu <tan.hu@zte.com.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
net/ipv6/netfilter/nf_nat_masquerade_ipv6.c