From: Qingfang Deng <qingfang.d...@siflower.com.cn> Backport the following changes from nft_flow_offload.c: 3412e1641828 ("netfilter: flowtable: nft_flow_route use more data for reverse route") 97629b237a8c ("netfilter: flowtable: fix nft_flow_route source address for nat case")
Signed-off-by: Qingfang Deng <qingfang.d...@siflower.com.cn> --- .../650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 13 +++++++++++-- .../650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 13 +++++++++++-- .../650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 13 +++++++++++-- 3 files changed, 33 insertions(+), 6 deletions(-) diff --git a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index ec887539d5..7a3c7cf857 100644 --- a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,701 @@ +@@ -0,0 +1,710 @@ +/* + * Copyright (C) 2018-2021 Felix Fietkau <n...@nbd.name> + * @@ -535,12 +535,21 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> + switch (xt_family(par)) { + case NFPROTO_IPV4: + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; ++ fl.u.ip4.saddr = ct->tuplehash[!dir].tuple.src.u3.ip; + fl.u.ip4.flowi4_oif = xt_in(par)->ifindex; ++ fl.u.ip4.flowi4_iif = this_dst->dev->ifindex; ++ fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); ++ fl.u.ip4.flowi4_mark = skb->mark; ++ fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC; + break; + case NFPROTO_IPV6: -+ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.dst.u3.in6; + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; ++ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.src.u3.in6; + fl.u.ip6.flowi6_oif = xt_in(par)->ifindex; ++ fl.u.ip6.flowi6_iif = this_dst->dev->ifindex; ++ fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(skb)); ++ fl.u.ip6.flowi6_mark = skb->mark; ++ fl.u.ip6.flowi6_flags = FLOWI_FLAG_ANYSRC; + break; + } + diff --git a/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index 6fdfc79207..972c8f1d31 100644 --- a/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -44,7 +44,7 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,702 @@ +@@ -0,0 +1,711 @@ +/* + * Copyright (C) 2018-2021 Felix Fietkau <n...@nbd.name> + * @@ -481,12 +481,21 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> + switch (xt_family(par)) { + case NFPROTO_IPV4: + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; ++ fl.u.ip4.saddr = ct->tuplehash[!dir].tuple.src.u3.ip; + fl.u.ip4.flowi4_oif = xt_in(par)->ifindex; ++ fl.u.ip4.flowi4_iif = this_dst->dev->ifindex; ++ fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); ++ fl.u.ip4.flowi4_mark = skb->mark; ++ fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC; + break; + case NFPROTO_IPV6: -+ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.dst.u3.in6; + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; ++ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.src.u3.in6; + fl.u.ip6.flowi6_oif = xt_in(par)->ifindex; ++ fl.u.ip6.flowi6_iif = this_dst->dev->ifindex; ++ fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(skb)); ++ fl.u.ip6.flowi6_mark = skb->mark; ++ fl.u.ip6.flowi6_flags = FLOWI_FLAG_ANYSRC; + break; + } + diff --git a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index 9735983212..c3ebb90e58 100644 --- a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -44,7 +44,7 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o --- /dev/null +++ b/net/netfilter/xt_FLOWOFFLOAD.c -@@ -0,0 +1,702 @@ +@@ -0,0 +1,711 @@ +/* + * Copyright (C) 2018-2021 Felix Fietkau <n...@nbd.name> + * @@ -481,12 +481,21 @@ Signed-off-by: Felix Fietkau <n...@nbd.name> + switch (xt_family(par)) { + case NFPROTO_IPV4: + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; ++ fl.u.ip4.saddr = ct->tuplehash[!dir].tuple.src.u3.ip; + fl.u.ip4.flowi4_oif = xt_in(par)->ifindex; ++ fl.u.ip4.flowi4_iif = this_dst->dev->ifindex; ++ fl.u.ip4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); ++ fl.u.ip4.flowi4_mark = skb->mark; ++ fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC; + break; + case NFPROTO_IPV6: -+ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.dst.u3.in6; + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; ++ fl.u.ip6.saddr = ct->tuplehash[!dir].tuple.src.u3.in6; + fl.u.ip6.flowi6_oif = xt_in(par)->ifindex; ++ fl.u.ip6.flowi6_iif = this_dst->dev->ifindex; ++ fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(skb)); ++ fl.u.ip6.flowi6_mark = skb->mark; ++ fl.u.ip6.flowi6_flags = FLOWI_FLAG_ANYSRC; + break; + } + -- 2.34.1 _______________________________________________ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel