netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too
Alex Efros reported rpfilter module doesn't match following packets: IN=br.qemu SRC=192.168.2.1 DST=192.168.2.255 [ .. ] (netfilter bugzilla #814). Problem is that network stack arranges for the locally generated broadcasts to appear on the interface they were sent out, so the IFF_LOOPBACK check doesn't trigger. As -m rpfilter is restricted to PREROUTING, we can check for existing rtable instead, it catches locally-generated broad/multicast case, too. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Родитель
5add189a12
Коммит
f83a7ea207
|
@ -66,6 +66,12 @@ static bool rpfilter_lookup_reverse(struct flowi4 *fl4,
|
|||
return dev_match;
|
||||
}
|
||||
|
||||
static bool rpfilter_is_local(const struct sk_buff *skb)
|
||||
{
|
||||
const struct rtable *rt = skb_rtable(skb);
|
||||
return rt && (rt->rt_flags & RTCF_LOCAL);
|
||||
}
|
||||
|
||||
static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
const struct xt_rpfilter_info *info;
|
||||
|
@ -76,7 +82,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
info = par->matchinfo;
|
||||
invert = info->flags & XT_RPFILTER_INVERT;
|
||||
|
||||
if (par->in->flags & IFF_LOOPBACK)
|
||||
if (rpfilter_is_local(skb))
|
||||
return true ^ invert;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
|
|
|
@ -71,6 +71,12 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb,
|
|||
return ret;
|
||||
}
|
||||
|
||||
static bool rpfilter_is_local(const struct sk_buff *skb)
|
||||
{
|
||||
const struct rt6_info *rt = (const void *) skb_dst(skb);
|
||||
return rt && (rt->rt6i_flags & RTF_LOCAL);
|
||||
}
|
||||
|
||||
static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
const struct xt_rpfilter_info *info = par->matchinfo;
|
||||
|
@ -78,7 +84,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
struct ipv6hdr *iph;
|
||||
bool invert = info->flags & XT_RPFILTER_INVERT;
|
||||
|
||||
if (par->in->flags & IFF_LOOPBACK)
|
||||
if (rpfilter_is_local(skb))
|
||||
return true ^ invert;
|
||||
|
||||
iph = ipv6_hdr(skb);
|
||||
|
|
Загрузка…
Ссылка в новой задаче