netfilter: nfnetlink_queue: add NAT TCP sequence adjustment if packet mangled
authorPablo Neira Ayuso <pablo@netfilter.org>
Thu, 7 Jun 2012 11:31:25 +0000 (13:31 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 16 Jun 2012 13:09:08 +0000 (15:09 +0200)
commit8c88f87cb27ad09086940bdd3e6955e5325ec89a
tree1acfa54ba78602eb4eb053110ffc0a54025318c7
parent9cb0176654a7dc33a32af8a0bc9e0b2f9f9ebb0f
netfilter: nfnetlink_queue: add NAT TCP sequence adjustment if packet mangled

User-space programs that receive traffic via NFQUEUE may mangle packets.
If NAT is enabled, this usually puzzles sequence tracking, leading to
traffic disruptions.

With this patch, nfnl_queue will make the corresponding NAT TCP sequence
adjustment if:

1) The packet has been mangled,
2) the NFQA_CFG_F_CONNTRACK flag has been set, and
3) NAT is detected.

There are some records on the Internet complaning about this issue:
http://stackoverflow.com/questions/260757/packet-mangling-utilities-besides-iptables

By now, we only support TCP since we have no helpers for DCCP or SCTP.
Better to add this if we ever have some helper over those layer 4 protocols.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/linux/netfilter.h
include/net/netfilter/nf_nat_helper.h
net/ipv4/netfilter/nf_nat_helper.c
net/netfilter/nf_conntrack_netlink.c
net/netfilter/nfnetlink_queue.c