On Thu, 2013-10-24 at 21:32 +0200, Florian Westphal wrote: > Pekka Pietikäinen reports xt_socket behavioural change after commit behavioral maybe ? ;) > 00028aa37098o (netfilter: xt_socket: use IP early demux). > > Reason is xt_socket now no longer does an unconditional sk lookup - > it re-uses existing skb->sk if possible, assuming ->sk was set by > tcp early demux. s/tcp/ip/ since it also can work for UDP sockets in net-next > > However, when netfilter is invoked via bridge, this can cause 'bogus' > sockets to be examined by the match, e.g. a 'tun' device socket. > > bridge netfilter should orphan the skb just like the routing path > before invoking ipv4/ipv6 netfilter hooks to avoid this. > > Reported-and-tested-by: Pekka Pietikäinen <pp@xxxxxxxxxx> > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c > index 878f008..80cad2c 100644 > --- a/net/bridge/br_netfilter.c > +++ b/net/bridge/br_netfilter.c > @@ -559,6 +559,8 @@ static struct net_device *setup_pre_routing(struct sk_buff *skb) > else if (skb->protocol == htons(ETH_P_PPP_SES)) > nf_bridge->mask |= BRNF_PPPoE; > > + /* Must drop socket now because of tproxy. */ > + skb_orphan(skb); > return skb->dev; > } > This was a nice one, thanks Florian ! Acked-by: Eric Dumazet <edumazet@xxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
