ramips: drop support for kernel 4.14
[openwrt/staging/dedeckeh.git] / target / linux / generic / backport-4.14 / 366-netfilter-nft_flow_offload-Fix-reverse-route-lookup.patch
1 From: wenxu <wenxu@ucloud.cn>
2 Date: Wed, 9 Jan 2019 10:40:11 +0800
3 Subject: [PATCH] netfilter: nft_flow_offload: Fix reverse route lookup
4
5 Using the following example:
6
7 client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
8
9 The first reply packet (ie. syn+ack) uses an incorrect destination
10 address for the reverse route lookup since it uses:
11
12 daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
13
14 which is 2.2.2.7 in the scenario that is described above, while this
15 should be:
16
17 daddr = ct->tuplehash[dir].tuple.src.u3.ip;
18
19 that is 10.0.0.7.
20
21 Signed-off-by: wenxu <wenxu@ucloud.cn>
22 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
23 ---
24
25 --- a/net/netfilter/nft_flow_offload.c
26 +++ b/net/netfilter/nft_flow_offload.c
27 @@ -29,10 +29,10 @@ static int nft_flow_route(const struct n
28 memset(&fl, 0, sizeof(fl));
29 switch (nft_pf(pkt)) {
30 case NFPROTO_IPV4:
31 - fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
32 + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
33 break;
34 case NFPROTO_IPV6:
35 - fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
36 + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
37 break;
38 }
39