Skip to content

Commit

Permalink
ip_forward: Drop frames with attached skb->sk
Browse files Browse the repository at this point in the history
Initial discussion was:
[FYI] xfrm: Don't lookup sk_policy for timewait sockets

Forwarded frames should not have a socket attached. Especially
tw sockets will lead to panics later-on in the stack.

This was observed with TPROXY assigning a tw socket and broken
policy routing (misconfigured). As a result frame enters
forwarding path instead of input. We cannot solve this in
TPROXY as it cannot know that policy routing is broken.

v2:
Remove useless comment

Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Sebastian Pöhn authored and David S. Miller committed Apr 20, 2015
1 parent 04b7fe6 commit 2ab9574
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions net/ipv4/ip_forward.c
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,9 @@ int ip_forward(struct sk_buff *skb)
if (skb->pkt_type != PACKET_HOST)
goto drop;

if (unlikely(skb->sk))
goto drop;

if (skb_warn_if_lro(skb))
goto drop;

Expand Down

0 comments on commit 2ab9574

Please sign in to comment.