UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/net/ipv4/netfilter
History
lucien cc4998febd netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse 
--accept-local  option works for res.type == RTN_LOCAL, which should be
from the local table, but there, the fib_info's nh->nh_scope =
RT_SCOPE_NOWHERE ( > RT_SCOPE_HOST). in fib_create_info().

	if (cfg->fc_scope == RT_SCOPE_HOST) {
		struct fib_nh *nh = fi->fib_nh;

		/* Local address is added. */
		if (nhs != 1 || nh->nh_gw)
			goto err_inval;
		nh->nh_scope = RT_SCOPE_NOWHERE;   <===
		nh->nh_dev = dev_get_by_index(net, fi->fib_nh->nh_oif);
		err = -ENODEV;
		if (!nh->nh_dev)
			goto failure;

but in our rpfilter_lookup_reverse():

	if (dev_match || flags & XT_RPFILTER_LOOSE)
		return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST;

if nh->nh_scope > RT_SCOPE_HOST, it will fail. --accept-local option
will never be passed.

it seems the test is bogus and can be removed to fix this issue.

	if (dev_match || flags & XT_RPFILTER_LOOSE)
		return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST;

ipv6 does not have this issue.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 		2015-10-12 17:27:48 +02:00
..
Kconfig netfilter: fix Kconfig dependencies for nf_dup_ipv{4,6} 2015-10-01 00:19:54 +02:00
Makefile netfilter: nf_tables: add nft_dup expression 2015-08-07 11:49:49 +02:00
arp_tables.c Revert "netfilter: xtables: compute exact size needed for jumpstack" 2015-08-28 21:04:11 +02:00
arpt_mangle.c netfilter: arpt_mangle: fix return values of checkentry 2011-02-01 16:03:46 +01:00
arptable_filter.c netfilter: Pass nf_hook_state through arpt_do_table(). 2015-04-04 13:26:52 -04:00
ip_tables.c Revert "netfilter: xtables: compute exact size needed for jumpstack" 2015-08-28 21:04:11 +02:00
ipt_CLUSTERIP.c netfilter: x_tables: add context to know if extension runs from nft_compat 2015-05-15 20:14:07 +02:00
ipt_ECN.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
ipt_MASQUERADE.c netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables 2014-09-09 16:31:29 +02:00
ipt_REJECT.c netfilter: reject: don't send icmp error if csum is invalid 2015-03-03 02:10:35 +01:00
ipt_SYNPROXY.c netfilter: SYNPROXY: fix sending window update to client 2015-08-10 13:55:07 +02:00
ipt_ah.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
ipt_rpfilter.c netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse 2015-10-12 17:27:48 +02:00
iptable_filter.c netfilter: Pass nf_hook_state through ipt_do_table(). 2015-04-04 12:47:04 -04:00
iptable_mangle.c netfilter: Pass nf_hook_state through ipt_do_table(). 2015-04-04 12:47:04 -04:00
iptable_nat.c netfilter: Pass nf_hook_state through ipt_do_table(). 2015-04-04 12:47:04 -04:00
iptable_raw.c netfilter: Pass nf_hook_state through ipt_do_table(). 2015-04-04 12:47:04 -04:00
iptable_security.c netfilter: Pass nf_hook_state through ipt_do_table(). 2015-04-04 12:47:04 -04:00
nf_conntrack_l3proto_ipv4.c netfilter: nf_conntrack: push zone object into functions 2015-08-11 12:29:01 +02:00
nf_conntrack_l3proto_ipv4_compat.c netfilter: Remove uses of seq_<foo> return values 2015-03-18 10:51:35 +01:00
nf_conntrack_proto_icmp.c netfilter: nf_conntrack: add efficient mark to zone mapping 2015-08-18 01:24:05 +02:00
nf_defrag_ipv4.c netfilter: nf_conntrack: add direction support for zones 2015-08-18 01:22:50 +02:00
nf_dup_ipv4.c netfilter: nf_dup{4, 6}: fix build error when nf_conntrack disabled 2015-09-02 16:28:06 -07:00
nf_log_arp.c netfilter: Use LOGLEVEL_<FOO> defines 2015-03-25 12:09:39 +01:00
nf_log_ipv4.c netfilter: Use LOGLEVEL_<FOO> defines 2015-03-25 12:09:39 +01:00
nf_nat_h323.c netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report() 2014-02-05 17:46:05 +01:00
nf_nat_l3proto_ipv4.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_masquerade_ipv4.c netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables 2014-09-09 16:31:29 +02:00
nf_nat_pptp.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_nat_proto_gre.c netfilter: use IS_ENABLED() macro 2014-06-30 11:38:03 +02:00
nf_nat_proto_icmp.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_snmp_basic.c netfilter: nf_nat_snmp_basic: fix duplicates in if/else branches 2014-02-14 11:37:36 +01:00
nf_reject_ipv4.c netfilter: bridge: add helpers for fetching physin/outdev 2015-04-08 16:49:08 +02:00
nf_tables_arp.c netfilter: Pass nf_hook_state through nft_set_pktinfo*(). 2015-04-04 12:54:27 -04:00
nf_tables_ipv4.c netfilter: Pass nf_hook_state through nft_set_pktinfo*(). 2015-04-04 12:54:27 -04:00
nft_chain_nat_ipv4.c netfilter: Pass nf_hook_state through nft_set_pktinfo*(). 2015-04-04 12:54:27 -04:00
nft_chain_route_ipv4.c netfilter: Pass nf_hook_state through nft_set_pktinfo*(). 2015-04-04 12:54:27 -04:00
nft_dup_ipv4.c netfilter: nf_dup: fix sparse warnings 2015-08-21 21:29:19 +02:00
nft_masq_ipv4.c netfilter: nf_tables: get rid of NFT_REG_VERDICT usage 2015-04-13 17:17:07 +02:00
nft_redir_ipv4.c netfilter: nf_tables: switch registers to 32 bit addressing 2015-04-13 17:17:29 +02:00
nft_reject_ipv4.c netfilter: nf_tables: get rid of NFT_REG_VERDICT usage 2015-04-13 17:17:07 +02:00