netfilter: flowtable: fix nft_flow_route source address for nat case

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

For snat and dnat cases, the saddr should be taken from reverse tuple.

Fixes: 3412e1641828 (netfilter: flowtable: nft_flow_route use more data for reverse route)
Signed-off-by: wenxu <wenxu@chinatelecom.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

authored by

wenxu and committed by

Pablo Neira Ayuso 3 years ago 97629b23 f1896d45

+2 -2

1 changed file

expand all

net

netfilter

nft_flow_offload.c

+2 -2

net/netfilter/nft_flow_offload.c

··· 232 232 switch (nft_pf(pkt)) { 233 233 case NFPROTO_IPV4: 234 234 fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; 235 - fl.u.ip4.saddr = ct->tuplehash[dir].tuple.dst.u3.ip; 235 + fl.u.ip4.saddr = ct->tuplehash[!dir].tuple.src.u3.ip; 236 236 fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex; 237 237 fl.u.ip4.flowi4_iif = this_dst->dev->ifindex; 238 238 fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(pkt->skb)->tos); ··· 241 241 break; 242 242 case NFPROTO_IPV6: 243 243 fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; 244 - fl.u.ip6.saddr = ct->tuplehash[dir].tuple.dst.u3.in6; 244 + fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.src.u3.in6; 245 245 fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex; 246 246 fl.u.ip6.flowi6_iif = this_dst->dev->ifindex; 247 247 fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(pkt->skb));