Commit 3412e164 authored by Sven Auhagen's avatar Sven Auhagen Committed by Pablo Neira Ayuso
Browse files

netfilter: flowtable: nft_flow_route use more data for reverse route 



When creating a flow table entry, the reverse route is looked
up based on the current packet.
There can be scenarios where the user creates a custom ip rule
to route the traffic differently.
In order to support those scenarios, the lookup needs to add
more information based on the current packet.
The patch adds multiple new information to the route lookup.

Signed-off-by: default avatarSven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8edc8131

net/netfilter/nft_flow_offload.c

+8 −0
Original line number Diff line number Diff line
@@ -227,11 +227,19 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, 
	switch (nft_pf(pkt)) {

	case NFPROTO_IPV4:

		fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;

		fl.u.ip4.saddr = ct->tuplehash[dir].tuple.dst.u3.ip;

		fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;

		fl.u.ip4.flowi4_iif = this_dst->dev->ifindex;

		fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(pkt->skb)->tos);

		fl.u.ip4.flowi4_mark = pkt->skb->mark;

		break;

	case NFPROTO_IPV6:

		fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;

		fl.u.ip6.saddr = ct->tuplehash[dir].tuple.dst.u3.in6;

		fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex;

		fl.u.ip6.flowi6_iif = this_dst->dev->ifindex;

		fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(pkt->skb));

		fl.u.ip6.flowi6_mark = pkt->skb->mark;

		break;

	}