Jozsef Kadlecsik f9dd09c7f7 netfilter: nf_nat: fix NAT issue in 2.6.30.4+ ... Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work over NAT. The "cause" of the problem was a fix of unacknowledged data detection with NAT (commit a3a9f79e36). However, actually, that fix uncovered a long standing bug in TCP conntrack: when NAT was enabled, we simply updated the max of the right edge of the segments we have seen (td_end), by the offset NAT produced with changing IP/port in the data. However, we did not update the other parameter (td_maxend) which is affected by the NAT offset. Thus that could drift away from the correct value and thus resulted breaking active FTP. The patch below fixes the issue by *not* updating the conntrack parameters from NAT, but instead taking into account the NAT offsets in conntrack in a consistent way. (Updating from NAT would be more harder and expensive because it'd need to re-calculate parameters we already calculated in conntrack.) Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2009-11-06 00:43:42 -08:00
..
ipv4
ipv6
nf_conntrack_acct.h
nf_conntrack_core.h
nf_conntrack_ecache.h
nf_conntrack_expect.h
nf_conntrack_extend.h
nf_conntrack_helper.h
nf_conntrack_l3proto.h
nf_conntrack_l4proto.h
nf_conntrack_tuple.h
nf_conntrack.h	netfilter: nf_nat: fix NAT issue in 2.6.30.4+	2009-11-06 00:43:42 -08:00
nf_log.h
nf_nat_core.h	netfilter: nfnetlink: constify message attributes and headers	2009-08-25 16:07:58 +02:00
nf_nat_helper.h	netfilter: nf_nat: fix NAT issue in 2.6.30.4+	2009-11-06 00:43:42 -08:00
nf_nat_protocol.h
nf_nat_rule.h
nf_nat.h
nf_queue.h
nf_tproxy_core.h
nfnetlink_log.h
xt_rateest.h