diff options
| author |   wenxu <wenxu@ucloud.cn> | 2019-01-09 10:40:11 +0800 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2019-01-09 23:25:02 +0100 |
| commit | a799aea0988ea0d1b1f263e996fdad2f6133c680 (patch) | |
| tree | 319c58a8050cf2421ef6b479df194b6705745004 /net/bridge | |
| parent | netfilter: nf_tables: selective rule dump needs table to be specified (diff) | |
| download | wireguard-linux-a799aea0988ea0d1b1f263e996fdad2f6133c680.tar.xz wireguard-linux-a799aea0988ea0d1b1f263e996fdad2f6133c680.zip | |
netfilter: nft_flow_offload: Fix reverse route lookup
Using the following example:
client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
The first reply packet (ie. syn+ack) uses an incorrect destination
address for the reverse route lookup since it uses:
daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
which is 2.2.2.7 in the scenario that is described above, while this
should be:
daddr = ct->tuplehash[dir].tuple.src.u3.ip;
that is 10.0.0.7.
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/bridge')
0 files changed, 0 insertions, 0 deletions