lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 8 Apr 2014 12:31:22 -0700 From: Cong Wang <xiyou.wangcong@...il.com> To: netdev@...r.kernel.org Cc: davem@...emloft.net, Eric Biederman <ebiederm@...ssion.com>, Julian Anastasov <ja@....bg>, Cong Wang <xiyou.wangcong@...il.com>, Cong Wang <cwang@...pensource.com> Subject: [Patch net] ipv4: fib: check forwarding before checking send_redirects From: Cong Wang <cwang@...pensource.com> We have seen in a weird case we had to disable send_redirects in order to pass rp filter check even though we don't set forwarding at all. This looks wrong, at least according to ip-sysctl.txt send_redirects should only make sense when we enable forwarding. Cc: Eric Biederman <ebiederm@...ssion.com> Cc: Julian Anastasov <ja@....bg> Cc: David S. Miller <davem@...emloft.net> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com> Signed-off-by: Cong Wang <cwang@...pensource.com> --- diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c index 1a629f8..3f9e324 100644 --- a/net/ipv4/fib_frontend.c +++ b/net/ipv4/fib_frontend.c @@ -321,7 +321,8 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev); if (!r && !fib_num_tclassid_users(dev_net(dev)) && - (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) { + (dev->ifindex != oif || !IN_DEV_FORWARD(idev) || + !IN_DEV_TX_REDIRECTS(idev))) { *itag = 0; return 0; } -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists