diff options
| author | David S. Miller <davem@davemloft.net> | 2012-06-21 14:58:10 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-06-21 14:58:10 -0700 |
| commit | fd62e09b946522ec3578412826a81bead06fadf7 (patch) | |
| tree | f105f85146261f7647928bd6e0b74c7f6398401f /net/ipv4/tcp_ipv4.c | |
| parent | 3e428fe0382fca48795b5cf9d4f03a89cda5d84d (diff) | |
| download | linux-fd62e09b946522ec3578412826a81bead06fadf7.tar.bz2 | |
tcp: Validate route interface in early demux.
Otherwise we might violate reverse path filtering.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
| -rw-r--r-- | net/ipv4/tcp_ipv4.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 13857df1dae1..21e22a00481a 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1676,6 +1676,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) struct net *net = dev_net(skb->dev); const struct iphdr *iph; const struct tcphdr *th; + struct net_device *dev; struct sock *sk; int err; @@ -1695,10 +1696,11 @@ int tcp_v4_early_demux(struct sk_buff *skb) if (!pskb_may_pull(skb, ip_hdrlen(skb) + th->doff * 4)) goto out_err; + dev = skb->dev; sk = __inet_lookup_established(net, &tcp_hashinfo, iph->saddr, th->source, iph->daddr, th->dest, - skb->dev->ifindex); + dev->ifindex); if (sk) { skb->sk = sk; skb->destructor = sock_edemux; @@ -1707,8 +1709,12 @@ int tcp_v4_early_demux(struct sk_buff *skb) if (dst) dst = dst_check(dst, 0); if (dst) { - skb_dst_set_noref(skb, dst); - err = 0; + struct rtable *rt = (struct rtable *) dst; + + if (rt->rt_iif == dev->ifindex) { + skb_dst_set_noref(skb, dst); + err = 0; + } } } } |