2 files changed, 17 insertions, 12 deletions

diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index adf25f9f70e1..6bcfdf6dfcc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -253,14 +253,17 @@ ip_nat_local_fn(unsigned int hooknum,
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.dst.ip !=
-                    ct->tuplehash[!dir].tuple.src.ip
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
+                    ct->tuplehash[!dir].tuple.src.ip) {
                         if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                 ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
+
         }
         return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index e4d3ef17d45b..15aa3db8cb33 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -245,14 +245,16 @@ nf_nat_local_fn(unsigned int hooknum,
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
-                    ct->tuplehash[!dir].tuple.src.u3.ip
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
+                    ct->tuplehash[!dir].tuple.src.u3.ip) {
                         if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                 ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
         }
         return ret;
 }