Re: linux 3.12 regression - snat problem with ftp helper

[Phil Oester <kernel@linuxace.com>]

[-- Attachment #1: Type: text/plain, Size: 552 bytes --]

On Fri, Nov 15, 2013 at 02:48:08PM +0100, Dawid Stawiarski - nazwa.pl wrote:
> hello,
> 
> after upgrade to mainline kernel v. 3.12 our machines are not able
> to connect to ftp service (from inside of the lxc containters).
> Mainline kernel 3.11.8 works fine.
> 
> in packet 8 host sends rewriten PORT command (with changed private
> to public IP) - however the packet has incorrect sequence number
> (should have 41).
> the ftp server responds with SACK but the host resets the connection.

Does the attached patch solve the problem for you?

Phil



[-- Attachment #2: patch-seqadj --]
[-- Type: text/plain, Size: 679 bytes --]

diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd0..17c1bcb 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 	spin_lock_bh(&ct->lock);
 	this_way = &seqadj->seq[dir];
 	if (this_way->offset_before == this_way->offset_after ||
-	    before(this_way->correction_pos, seq)) {
-		this_way->correction_pos = seq;
+	    before(this_way->correction_pos, ntohl(seq))) {
+		this_way->correction_pos = ntohl(seq);
 		this_way->offset_before	 = this_way->offset_after;
 		this_way->offset_after	+= off;
 	}