allow loopback src address in listener (#1730)

2026-05-07 02:09:06 +00:00 · 2026-01-01 00:41:56 +08:00
parent 7c563153ae
commit 4e651a72f7
7 changed files with 99 additions and 52 deletions
@@ -733,6 +733,18 @@ impl<C: NatDstConnector> TcpProxy<C> {
        let nat_dst = if Some(nat_entry.real_dst.ip())
            == global_ctx.get_ipv4().map(|ip| IpAddr::V4(ip.address()))
        {
+            if global_ctx.is_port_in_running_listeners(nat_entry.real_dst.port(), false)
+                && global_ctx.is_ip_in_same_network(&nat_entry.src.ip())
+            {
+                tracing::error!(
+                    ?nat_entry,
+                    "nat dst port {} is in running listeners, ignore it",
+                    nat_entry.real_dst.port()
+                );
+                nat_entry.state.store(NatDstEntryState::Closed);
+                Self::remove_entry_from_all_conn_map(conn_map, addr_conn_map, nat_entry);
+                return;
+            }
            format!("127.0.0.1:{}", nat_entry.real_dst.port())
                .parse()
                .unwrap()