search for: nf_nat_cor

...00000 R12: ffff88047f0bfef8 R13: ffffffff8100c9ce R14: ffffffff813abbf8 R15: ffff88047f0bfef8 ORIG_RAX: ffffffffffffff41 CS: 0010 SS: 0018 #32 [ffff88047f0bff00] cpu_idle at ffffffff8100ae7d gdb nf_nat.ko (gdb) l* nf_nat_setup_info+1497 0xf49 is in nf_nat_setup_info (net/ipv4/netfilter/nf_nat_core.c:135). 130 const struct nf_conntrack_tuple *tuple) 131 { 132 const struct nf_conntrack_tuple *t; 133 134 t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 135 return (t->dst.protonum == tuple->dst.protonum && 136...

...tiosity.com Take a rule like this: ip6tables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1000::1:ffff:ffff-1000::2:0:0 The kernel was then observed choosing the address 1000::2:ffff:ffff as the translation, which is outside the specified range. This is the code in find_best_ips_proto() in nf_nat_core.c. It assumes that in each u32 of the IPv6 address, the minimum value is not larger than the maximum, even though that is only required for the most significant u32 of the address. It also assumes the minimum will be zero (full_range) whenever the previously chosen u32 was not the maximum, which m...

...2 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 6 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_nat_core.c | 10 +- net/netfilter/nf_synproxy_core.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nft_cmp.c...

...2 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 6 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_nat_core.c | 10 +- net/netfilter/nf_synproxy_core.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nft_cmp.c...

...2 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 6 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_nat_core.c | 10 +- net/netfilter/nf_synproxy_core.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nft_cmp.c...

...2 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 6 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_nat_core.c | 10 +- net/netfilter/nf_synproxy_core.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nft_cmp.c...

...2 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 2 +- net/netfilter/nf_conntrack_h323_asn1.c | 6 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_nat_core.c | 10 +- net/netfilter/nf_synproxy_core.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nft_cmp.c...