netfilter: nf_nat: don't bug when mapping already exists

It seems preferrable to limp along if we have a conflicting mapping,
its certainly better than a BUG().

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 40573aa6c133f884c88332e68f7b29b802a50c35..dc3519cc720956e0b6f26c7d305f3dbb016adc38 100644 (file)
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -416,7 +416,9 @@ nf_nat_setup_info(struct nf_conn *ct,
 
        WARN_ON(maniptype != NF_NAT_MANIP_SRC &&
                maniptype != NF_NAT_MANIP_DST);
-       BUG_ON(nf_nat_initialized(ct, maniptype));
+
+       if (WARN_ON(nf_nat_initialized(ct, maniptype)))
+               return NF_DROP;
 
        /* What we've got will look like inverse of reply. Normally
         * this is what is in the conntrack, except for prior