FTP passive mode got broken by this change:
- if (.. && nfct_nat(ct)) {
+ if (.. (ct->status & IPS_NAT_MASK)) {
The PASV reply sent by real server need to be translated to contain
the load balancers address, but they are passed unchanged.
IPS_NAT_MASK should be true for connections where reverse
of reply tuple isn't the original tupe (i.e. connection had
its source/destination changed), but ipvs uses a different function
to replace the reply tuple address, and did not set SRC/DST NAT bit.
Reported-by: Li Shuang <shuali@xxxxxxxxxx>
Fixes: 41390895e50bc4 ("netfilter: ipvs: don't check for presence of nat extension")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
net/netfilter/ipvs/ip_vs_nfct.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
index 6cf3fd81a5ec..0ceac36819d9 100644
--- a/net/netfilter/ipvs/ip_vs_nfct.c
+++ b/net/netfilter/ipvs/ip_vs_nfct.c
@@ -119,13 +119,17 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
if (outin) {
new_tuple.src.u3 = cp->daddr;
if (new_tuple.dst.protonum != IPPROTO_ICMP &&
- new_tuple.dst.protonum != IPPROTO_ICMPV6)
+ new_tuple.dst.protonum != IPPROTO_ICMPV6) {
new_tuple.src.u.tcp.port = cp->dport;
+ ct->status |= IPS_SRC_NAT;
+ }
} else {
new_tuple.dst.u3 = cp->vaddr;
if (new_tuple.dst.protonum != IPPROTO_ICMP &&
- new_tuple.dst.protonum != IPPROTO_ICMPV6)
+ new_tuple.dst.protonum != IPPROTO_ICMPV6) {
new_tuple.dst.u.tcp.port = cp->vport;
+ ct->status |= IPS_DST_NAT;
+ }
}
IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "
"ctinfo=%d, old reply=" FMT_TUPLE
--
2.16.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
