diff options
| author | Miaohe Lin | 2019-07-02 05:59:36 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2019-07-16 13:16:47 +0200 |
| commit | b575b24b8eee37f10484e951b62ce2a31c579775 (patch) | |
| tree | ae7972ecd1997e860b009fa17ded693d1ea6d6fb /net/ipv4 | |
| parent | netfilter: nfnetlink: avoid deadlock due to synchronous request_module (diff) | |
| download | kernel-qcow2-linux-b575b24b8eee37f10484e951b62ce2a31c579775.tar.gz kernel-qcow2-linux-b575b24b8eee37f10484e951b62ce2a31c579775.tar.xz kernel-qcow2-linux-b575b24b8eee37f10484e951b62ce2a31c579775.zip | |
netfilter: Fix rpfilter dropping vrf packets by mistake
When firewalld is enabled with ipv4/ipv6 rpfilter, vrf
ipv4/ipv6 packets will be dropped. Vrf device will pass
through netfilter hook twice. One with enslaved device
and another one with l3 master device. So in device may
dismatch witch out device because out device is always
enslaved device.So failed with the check of the rpfilter
and drop the packets by mistake.
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/netfilter/ipt_rpfilter.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c index 59031670b16a..cc23f1ce239c 100644 --- a/net/ipv4/netfilter/ipt_rpfilter.c +++ b/net/ipv4/netfilter/ipt_rpfilter.c @@ -78,6 +78,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; flow.flowi4_tos = RT_TOS(iph->tos); flow.flowi4_scope = RT_SCOPE_UNIVERSE; + flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; } |