diff options
| author | Patrick McHardy <kaber@trash.net> | 2011-01-26 16:28:45 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-01-26 16:28:45 +0100 |
| commit | 2e0348c449683a837644bb0027dbe5940b150c25 (patch) | |
| tree | 17152612e7ec1844b46c36565d56297a00b112b1 | |
| parent | 9f4e1ccd80530609bbceec68ae3831697b5c6a68 (diff) | |
| parent | ad86e1f27a9a97a9e50810b10bca678407b1d6fd (diff) | |
Merge branch 'connlimit' of git://dev.medozas.de/linux
| -rw-r--r-- | net/netfilter/xt_connlimit.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index 7fd3fd51f274..e029c4807404 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -185,11 +185,15 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) int connections; ct = nf_ct_get(skb, &ctinfo); - if (ct != NULL) - tuple_ptr = &ct->tuplehash[0].tuple; - else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), - par->family, &tuple)) + if (ct != NULL) { + if (info->flags & XT_CONNLIMIT_DADDR) + tuple_ptr = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; + else + tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; + } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), + par->family, &tuple)) { goto hotdrop; + } if (par->family == NFPROTO_IPV6) { const struct ipv6hdr *iph = ipv6_hdr(skb); |