netfilter: nf_nat: don't bug when mapping already exists
authorFlorian Westphal <fw@strlen.de>
Thu, 31 Aug 2017 11:45:24 +0000 (13:45 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 8 Sep 2017 16:55:26 +0000 (18:55 +0200)
It seems preferrable to limp along if we have a conflicting mapping,
its certainly better than a BUG().

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_nat_core.c

index 40573aa6c133f884c88332e68f7b29b802a50c35..dc3519cc720956e0b6f26c7d305f3dbb016adc38 100644 (file)
@@ -416,7 +416,9 @@ nf_nat_setup_info(struct nf_conn *ct,
 
        WARN_ON(maniptype != NF_NAT_MANIP_SRC &&
                maniptype != NF_NAT_MANIP_DST);
-       BUG_ON(nf_nat_initialized(ct, maniptype));
+
+       if (WARN_ON(nf_nat_initialized(ct, maniptype)))
+               return NF_DROP;
 
        /* What we've got will look like inverse of reply. Normally
         * this is what is in the conntrack, except for prior