diff options
author | Florian Westphal | 2019-04-09 14:45:20 +0200 |
---|---|---|
committer | Pablo Neira Ayuso | 2019-04-15 07:31:50 +0200 |
commit | 5bdac418f33f60b07a34e01e722889140ee8fac9 (patch) | |
tree | 8dd81d36f4c9ba89f4ad8779f8055e24f8069118 /net/netfilter/xt_HL.c | |
parent | netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook() (diff) | |
download | kernel-qcow2-linux-5bdac418f33f60b07a34e01e722889140ee8fac9.tar.gz kernel-qcow2-linux-5bdac418f33f60b07a34e01e722889140ee8fac9.tar.xz kernel-qcow2-linux-5bdac418f33f60b07a34e01e722889140ee8fac9.zip |
netfilter: nat: fix icmp id randomization
Sven Auhagen reported that a 2nd ping request will fail if 'fully-random'
mode is used.
Reason is that if no proto information is given, min/max are both 0,
so we set the icmp id to 0 instead of chosing a random value between
0 and 65535.
Update test case as well to catch this, without fix this yields:
[..]
ERROR: cannot ping ns1 from ns2 with ip masquerade fully-random (attempt 2)
ERROR: cannot ping ns1 from ns2 with ipv6 masquerade fully-random (attempt 2)
... becaus 2nd ping clashes with existing 'id 0' icmp conntrack and gets
dropped.
Fixes: 203f2e78200c27e ("netfilter: nat: remove l4proto->unique_tuple")
Reported-by: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/xt_HL.c')
0 files changed, 0 insertions, 0 deletions