1 From: wenxu <wenxu@ucloud.cn>
2 Date: Wed, 9 Jan 2019 10:40:11 +0800
3 Subject: [PATCH] netfilter: nft_flow_offload: Fix reverse route lookup
5 Using the following example:
7 client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
9 The first reply packet (ie. syn+ack) uses an incorrect destination
10 address for the reverse route lookup since it uses:
12 daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
14 which is 2.2.2.7 in the scenario that is described above, while this
17 daddr = ct->tuplehash[dir].tuple.src.u3.ip;
21 Signed-off-by: wenxu <wenxu@ucloud.cn>
22 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
25 --- a/net/netfilter/nft_flow_offload.c
26 +++ b/net/netfilter/nft_flow_offload.c
27 @@ -29,10 +29,10 @@ static int nft_flow_route(const struct n
28 memset(&fl, 0, sizeof(fl));
29 switch (nft_pf(pkt)) {
31 - fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
32 + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
35 - fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
36 + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;