netfilter: nat: fix spurious connection timeouts
authorFlorian Westphal <fw@strlen.de>
Fri, 8 Feb 2019 15:39:52 +0000 (16:39 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 11 Feb 2019 16:43:17 +0000 (17:43 +0100)
commit8303b7e8f018724a2cd7752eb29c2801fa8c4067
tree28fa7db49fc8e1f5b1727808e4ce836f6ab04af3
parentc4c07b4d6fa1f11880eab8e076d3d060ef3f55fc
netfilter: nat: fix spurious connection timeouts

Sander Eikelenboom bisected a NAT related regression down
to the l4proto->manip_pkt indirection removal.

I forgot that ICMP(v6) errors (e.g. PKTTOOBIG) can be set as related
to the existing conntrack entry.

Therefore, when passing the skb to nf_nat_ipv4/6_manip_pkt(), that
ended up calling the wrong l4 manip function, as tuple->dst.protonum
is the original flows l4 protocol (TCP, UDP, etc).

Set the dst protocol field to ICMP(v6), we already have a private copy
of the tuple due to the inversion of src/dst.

Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
Fixes: faec18dbb0405 ("netfilter: nat: remove l4proto->manip_pkt")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c