Commit c2f7a528 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman

netfilter: nft_flow_offload: set liberal tracking mode for tcp

commit 8437a620 upstream.

Without it, whenever a packet has to be pushed up the stack (e.g. because
of mtu mismatch), then conntrack will flag packets as invalid, which in
turn breaks NAT.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fa84c445
...@@ -72,6 +72,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, ...@@ -72,6 +72,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
struct nf_flow_route route; struct nf_flow_route route;
struct flow_offload *flow; struct flow_offload *flow;
enum ip_conntrack_dir dir; enum ip_conntrack_dir dir;
bool is_tcp = false;
struct nf_conn *ct; struct nf_conn *ct;
int ret; int ret;
...@@ -84,6 +85,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, ...@@ -84,6 +85,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
case IPPROTO_TCP: case IPPROTO_TCP:
is_tcp = true;
break;
case IPPROTO_UDP: case IPPROTO_UDP:
break; break;
default: default:
...@@ -109,6 +112,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, ...@@ -109,6 +112,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (!flow) if (!flow)
goto err_flow_alloc; goto err_flow_alloc;
if (is_tcp) {
ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
}
ret = flow_offload_add(flowtable, flow); ret = flow_offload_add(flowtable, flow);
if (ret < 0) if (ret < 0)
goto err_flow_add; goto err_flow_add;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment