lkml.org 
[lkml]   [2019]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 37/83] netfilter: nft_flow_offload: Fix reverse route lookup
    Date
    From: wenxu <wenxu@ucloud.cn>

    [ Upstream commit a799aea0988ea0d1b1f263e996fdad2f6133c680 ]

    Using the following example:

    client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server

    The first reply packet (ie. syn+ack) uses an incorrect destination
    address for the reverse route lookup since it uses:

    daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;

    which is 2.2.2.7 in the scenario that is described above, while this
    should be:

    daddr = ct->tuplehash[dir].tuple.src.u3.ip;

    that is 10.0.0.7.

    Signed-off-by: wenxu <wenxu@ucloud.cn>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_flow_offload.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
    index 5fd4c57c79cc..e0c04851a349 100644
    --- a/net/netfilter/nft_flow_offload.c
    +++ b/net/netfilter/nft_flow_offload.c
    @@ -29,10 +29,10 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
    memset(&fl, 0, sizeof(fl));
    switch (nft_pf(pkt)) {
    case NFPROTO_IPV4:
    - fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
    + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
    break;
    case NFPROTO_IPV6:
    - fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
    + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
    break;
    }

    --
    2.19.1
    \
     
     \ /
      Last update: 2019-02-13 03:55    [W:7.213 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site