bridge: netfilter: orphan skb before invoking ip netfilter hooks
Pekka Pietikäinen reports xt_socket behavioural change after commit 00028aa37098o (netfilter: xt_socket: use IP early demux). Reason is xt_socket now no longer does an unconditional sk lookup - it re-uses existing skb->sk if possible, assuming ->sk was set by ip early demux. However, when netfilter is invoked via bridge, this can cause 'bogus' sockets to be examined by the match, e.g. a 'tun' device socket. bridge netfilter should orphan the skb just like the routing path before invoking ipv4/ipv6 netfilter hooks to avoid this. Reported-and-tested-by: Pekka Pietikäinen <pp@ee.oulu.fi> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
1e56555ee1
commit
6b8dbcf2c4
|
@ -559,6 +559,8 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb)
|
||||||
else if (skb->protocol == htons(ETH_P_PPP_SES))
|
else if (skb->protocol == htons(ETH_P_PPP_SES))
|
||||||
nf_bridge->mask |= BRNF_PPPoE;
|
nf_bridge->mask |= BRNF_PPPoE;
|
||||||
|
|
||||||
|
/* Must drop socket now because of tproxy. */
|
||||||
|
skb_orphan(skb);
|
||||||
return skb->dev;
|
return skb->dev;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue