[NETFILTER]: nf_nat_sip: only perform RTP DNAT if SIP session was SNATed

DNAT of the the RTP session is only necessary if the SIP session has
been SNATed.

Signed-off-by: Jerome Borsboom <j.borsboom@erasmusmc.nl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 1 deletions

diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index fac97cf51ae5..a32d746c4592 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -260,7 +260,11 @@ static unsigned int ip_nat_sdp(struct sk_buff **pskb,
         DEBUGP("ip_nat_sdp():\n");
 
         /* Connection will come from reply */
-        newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
+        if (ct->tuplehash[dir].tuple.src.u3.ip ==
+            ct->tuplehash[!dir].tuple.dst.u3.ip)
+                newip = exp->tuple.dst.u3.ip;
+        else
+                newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
 
         exp->saved_ip = exp->tuple.dst.u3.ip;
         exp->tuple.dst.u3.ip = newip;