diff options
author | Felix Fietkau <nbd@nbd.name> | 2019-09-25 19:39:51 +0200 |
---|---|---|
committer | Felix Fietkau <nbd@nbd.name> | 2019-09-25 20:11:20 +0200 |
commit | c8933ce53365671de98a303c8d94e089ea76754e (patch) | |
tree | 092a41293c39a5b697a007be07d898cd3d31b72f /target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch | |
parent | 442ecce76169d362b1c7ec4ba0a0e099dcbc8e29 (diff) | |
download | upstream-c8933ce53365671de98a303c8d94e089ea76754e.tar.gz upstream-c8933ce53365671de98a303c8d94e089ea76754e.tar.bz2 upstream-c8933ce53365671de98a303c8d94e089ea76754e.zip |
kernel: fix issues with output routing in flow offload
Replace an old cleanup patch that never made it upstream with the proper
upstream fix. This patch was incompatible with the recent changes that
affected the way that the flow tuple dst entry was used.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch')
-rw-r--r-- | target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch b/target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch new file mode 100644 index 0000000000..e91aaa91d7 --- /dev/null +++ b/target/linux/generic/backport-4.14/366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch @@ -0,0 +1,39 @@ +From: wenxu <wenxu@ucloud.cn> +Date: Wed, 9 Jan 2019 10:40:11 +0800 +Subject: [PATCH] netfilter: nft_flow_offload: Fix reverse route lookup + +Using the following example: + + client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server + +The first reply packet (ie. syn+ack) uses an incorrect destination +address for the reverse route lookup since it uses: + + daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; + +which is 2.2.2.7 in the scenario that is described above, while this +should be: + + daddr = ct->tuplehash[dir].tuple.src.u3.ip; + +that is 10.0.0.7. + +Signed-off-by: wenxu <wenxu@ucloud.cn> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -29,10 +29,10 @@ static int nft_flow_route(const struct n + memset(&fl, 0, sizeof(fl)); + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: +- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; ++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; + break; + case NFPROTO_IPV6: +- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; ++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; + break; + } + |