• Julian Anastasov's avatar
    netfilter: Fix ip_route_me_harder triggering ip_rt_bug · ed6e4ef8
    Julian Anastasov authored
    	Avoid creating input routes with ip_route_me_harder.
    It does not work for locally generated packets. Instead,
    restrict sockets to provide valid saddr for output route (or
    unicast saddr for transparent proxy). For other traffic
    allow saddr to be unicast or local but if callers forget
    to check saddr type use 0 for the output route.
    
    	The resulting handling should be:
    
    - REJECT TCP:
    	- in INPUT we can provide addr_type = RTN_LOCAL but
    	better allow rejecting traffic delivered with
    	local route (no IP address => use RTN_UNSPEC to
    	allow also RTN_UNICAST).
    	- FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
    	saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
    	- OUTPUT: RTN_UNSPEC
    
    - NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT
    
    - IPVS:
    	- use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
    	to restrict saddr to be local
    Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ed6e4ef8
netfilter.c 6.23 KB