You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
40 lines
1.1 KiB
Diff
40 lines
1.1 KiB
Diff
From: wenxu <wenxu@ucloud.cn>
|
|
Date: Wed, 9 Jan 2019 10:40:11 +0800
|
|
Subject: [PATCH] netfilter: nft_flow_offload: Fix reverse route lookup
|
|
|
|
Using the following example:
|
|
|
|
client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
|
|
|
|
The first reply packet (ie. syn+ack) uses an incorrect destination
|
|
address for the reverse route lookup since it uses:
|
|
|
|
daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
|
|
|
|
which is 2.2.2.7 in the scenario that is described above, while this
|
|
should be:
|
|
|
|
daddr = ct->tuplehash[dir].tuple.src.u3.ip;
|
|
|
|
that is 10.0.0.7.
|
|
|
|
Signed-off-by: wenxu <wenxu@ucloud.cn>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
|
|
--- a/net/netfilter/nft_flow_offload.c
|
|
+++ b/net/netfilter/nft_flow_offload.c
|
|
@@ -29,10 +29,10 @@ static int nft_flow_route(const struct n
|
|
memset(&fl, 0, sizeof(fl));
|
|
switch (nft_pf(pkt)) {
|
|
case NFPROTO_IPV4:
|
|
- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
|
|
+ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
|
|
break;
|
|
case NFPROTO_IPV6:
|
|
- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
|
|
+ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
|
|
break;
|
|
}
|
|
|