On Sun, Feb 25, 2018 at 10:29:18PM +0200, Julian Anastasov wrote:
> The IPS_NAT_MASK check in 4.12 replaced previous check for nfct_nat()
> which was needed to fix a crash in 2.6.36-rc, see
> commit 7bcbf81a2296 ("ipvs: avoid oops for passive FTP").
> But as IPVS does not set the IPS_SRC_NAT and IPS_DST_NAT bits,
> checking for IPS_NAT_MASK prevents PASV response to be properly
> mangled and blocks the transfer. Remove the check as it is not
> needed after 3.12 commit 41d73ec053d2 ("netfilter: nf_conntrack:
> make sequence number adjustments usuable without NAT") which
> changes nfct_nat() with nfct_seqadj() and especially after 3.13
> commit b25adce16064 ("ipvs: correct usage/allocation of seqadj
> ext in ipvs").
>
> Thanks to Li Shuang and Florian Westphal for reporting the problem!
>
> Reported-by: Li Shuang <shuali@xxxxxxxxxx>
> Fixes: be7be6e161a2 ("netfilter: ipvs: fix incorrect conflict resolution")
> Signed-off-by: Julian Anastasov <ja@xxxxxx>
Acked-by: Simon Horman <horms@xxxxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
