From: Changli Gao Date: Tue, 15 Mar 2011 12:23:28 +0000 (+0100) Subject: netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario X-Git-Tag: v2.6.39-rc1~468^2~26^2~8 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8183e3a88aced228ab9770762692be6cc3786e80;p=pandora-kernel.git netfilter: xt_connlimit: fix daddr connlimit in SNAT scenario We use the reply tuples when limiting the connections by the destination addresses, however, in SNAT scenario, the final reply tuples won't be ready until SNAT is done in POSTROUING or INPUT chain, and the following nf_conntrack_find_get() in count_tem() will get nothing, so connlimit can't work as expected. In this patch, the original tuples are always used, and an additional member addr is appended to save the address in either end. Signed-off-by: Changli Gao Signed-off-by: Patrick McHardy --- Reading git-diff-tree failed