netfilter: nf_flow_table: fix checksum when handling DNAT

Add a missing call to csum_replace4 like on SNAT.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
index 25d2975da156fb015848a8fe7e0f6f8cc9d4842b..282b9cc4fe824eefa51c10dae63c2424153eac00 100644 (file)
--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
@@ -111,6 +111,7 @@ static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
        default:
                return -1;
        }
+       csum_replace4(&iph->check, addr, new_addr);
 
        return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
 }