diff options
| author | Florian Westphal <fw@strlen.de> | 2013-10-24 23:32:42 +0400 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-10-28 00:44:33 +0400 |
| commit | 6b8dbcf2c44fd7aa716560d04e9857c870bd510c (patch) | |
| tree | 6a27588d35da7f83f10a4a299cdb98062570dc9f /net/netfilter/ipvs/ip_vs_proto_sctp.c | |
| parent | 1e56555ee1f3d04d89bdaa3df57ad2da9fbc0999 (diff) | |
| download | linux-6b8dbcf2c44fd7aa716560d04e9857c870bd510c.tar.xz | |
bridge: netfilter: orphan skb before invoking ip netfilter hooks
Pekka Pietikäinen reports xt_socket behavioural change after commit
00028aa37098o (netfilter: xt_socket: use IP early demux).
Reason is xt_socket now no longer does an unconditional sk lookup -
it re-uses existing skb->sk if possible, assuming ->sk was set by
ip early demux.
However, when netfilter is invoked via bridge, this can cause 'bogus'
sockets to be examined by the match, e.g. a 'tun' device socket.
bridge netfilter should orphan the skb just like the routing path
before invoking ipv4/ipv6 netfilter hooks to avoid this.
Reported-and-tested-by: Pekka Pietikäinen <pp@ee.oulu.fi>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/ipvs/ip_vs_proto_sctp.c')
0 files changed, 0 insertions, 0 deletions