diff options
| author | wenxu | 2019-01-09 03:40:11 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-02-27 10:08:53 +0100 |
| commit | 535be4692ffc89b3446a4970dd3404d36a075b0a (patch) | |
| tree | 0dd6f19ddb3a917e070732f0fb9ed5486e619427 /net/netfilter | |
| parent | MIPS: jazz: fix 64bit build (diff) | |
| download | kernel-qcow2-linux-535be4692ffc89b3446a4970dd3404d36a075b0a.tar.gz kernel-qcow2-linux-535be4692ffc89b3446a4970dd3404d36a075b0a.tar.xz kernel-qcow2-linux-535be4692ffc89b3446a4970dd3404d36a075b0a.zip | |
netfilter: nft_flow_offload: Fix reverse route lookup
[ Upstream commit a799aea0988ea0d1b1f263e996fdad2f6133c680 ]
Using the following example:
client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
The first reply packet (ie. syn+ack) uses an incorrect destination
address for the reverse route lookup since it uses:
daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
which is 2.2.2.7 in the scenario that is described above, while this
should be:
daddr = ct->tuplehash[dir].tuple.src.u3.ip;
that is 10.0.0.7.
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_flow_offload.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index 5fd4c57c79cc..e0c04851a349 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -29,10 +29,10 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, memset(&fl, 0, sizeof(fl)); switch (nft_pf(pkt)) { case NFPROTO_IPV4: - fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; break; case NFPROTO_IPV6: - fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; break; } |