Florian Westphal d503b30bd6
netfilter: tproxy: do not assign timewait sockets to skb->sk ...
Assigning a socket in timewait state to skb->sk can trigger
kernel oops, e.g. in nfnetlink_log, which does:
if (skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file) ...
in the timewait case, accessing sk->sk_callback_lock and sk->sk_socket
is invalid.
Either all of these spots will need to add a test for sk->sk_state != TCP_TIME_WAIT,
or xt_TPROXY must not assign a timewait socket to skb->sk.
This does the latter.
If a TW socket is found, assign the tproxy nfmark, but skip the skb->sk assignment,
thus mimicking behaviour of a '-m socket .. -j MARK/ACCEPT' re-routing rule.
The 'SYN to TW socket' case is left unchanged -- we try to redirect to the
listener socket.
Cc: Balazs Scheidler <bazsi@balabit.hu>
Cc: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-17 11:32:38 +01:00
2010-10-28 09:08:49 -05:00
2010-12-22 22:58:07 -02:00
2010-11-15 11:07:16 -08:00
2010-09-23 14:33:39 -07:00
2010-03-30 22:02:32 +09:00
2011-02-17 11:32:38 +01:00
2010-11-21 10:05:10 -08:00
2011-01-10 13:33:17 -08:00
2011-01-19 16:51:29 -08:00
2010-08-20 01:42:59 -07:00
2010-06-11 18:37:08 -07:00
2010-12-02 13:27:33 -08:00
2009-08-12 21:54:50 -07:00
2010-11-29 09:45:15 -08:00
2011-01-13 21:48:25 -08:00
2011-01-10 16:10:37 -08:00
2009-01-21 14:01:59 -08:00
2010-03-30 22:02:32 +09:00
2009-03-24 23:32:03 -07:00
2011-01-10 15:40:52 -05:00
2008-11-19 15:44:53 -08:00
2009-03-28 15:01:36 +11:00
2010-10-07 09:43:45 +02:00
2009-12-11 15:07:56 -08:00
2010-12-31 10:47:46 -08:00
2010-12-31 10:50:54 -08:00
2010-11-08 13:50:08 -08:00
2010-03-27 19:23:46 -07:00
2010-06-03 03:21:52 -07:00
2010-11-11 17:07:48 -08:00
2010-11-10 12:12:00 -08:00
2009-03-21 19:06:54 -07:00
2010-12-14 13:01:14 -08:00
2010-12-14 13:01:14 -08:00
2009-03-27 00:16:21 -07:00
2010-10-27 11:37:32 -07:00
2010-12-26 22:37:05 -08:00
2010-10-25 13:09:44 -07:00
2009-11-04 05:06:25 -08:00
2010-10-05 13:35:30 -04:00
2010-08-21 23:05:39 -07:00
2010-04-13 14:49:31 -07:00
2010-02-08 16:50:53 -05:00
2009-11-06 14:32:18 +03:00
2009-07-23 17:08:51 +04:00
2010-11-24 11:16:42 -08:00
2010-12-02 10:59:22 -08:00
2009-12-08 20:17:51 -08:00
2010-07-12 20:21:46 -07:00
2010-12-19 21:59:35 -08:00
2010-09-23 14:33:39 -07:00
2010-06-30 13:44:29 -07:00
2010-10-21 13:06:43 +02:00
2010-12-09 20:05:58 -08:00
2010-12-09 20:05:58 -08:00
2010-12-01 17:29:08 -08:00
2010-11-30 12:27:11 -08:00
2010-12-20 13:24:14 -08:00
2010-10-25 13:09:45 -07:00
2010-10-28 10:27:03 -07:00
2010-10-21 11:04:43 +02:00
2010-12-12 22:08:17 -08:00
2010-02-16 23:05:38 -08:00
2008-06-11 21:00:38 -07:00
2010-10-27 11:37:32 -07:00
2010-09-23 14:33:39 -07:00
2010-06-03 03:21:52 -07:00
2010-03-31 14:49:12 -04:00
2010-07-26 15:09:04 -04:00
2009-12-26 20:43:57 -08:00
2008-03-31 21:02:47 -07:00
2008-03-31 21:02:47 -07:00
2009-12-26 20:46:28 -08:00
2011-01-10 15:40:52 -05:00
2010-06-03 03:21:52 -07:00
2010-04-23 13:35:55 +09:00
2010-12-02 13:27:33 -08:00
2010-11-19 13:13:47 -08:00
2010-10-25 14:18:27 -07:00
2009-01-06 11:38:15 -07:00
2010-03-30 22:02:32 +09:00
2010-11-16 09:52:32 -08:00
2010-03-30 22:02:32 +09:00
2009-08-19 23:08:22 +04:00
2010-12-21 12:43:16 -08:00
2010-06-02 03:23:51 -07:00
2010-10-27 11:37:31 -07:00
2009-03-21 19:06:50 -07:00
2010-09-08 13:42:22 -07:00
2009-06-23 04:31:07 -07:00
2011-01-12 19:00:39 -08:00
2010-11-22 15:48:51 -05:00
2010-01-17 19:09:39 -08:00
2009-07-26 19:11:14 -07:00
2010-12-20 10:37:19 -08:00
2010-11-27 22:56:08 -08:00
2011-01-10 16:07:54 -08:00
2010-11-24 11:16:43 -08:00
2010-12-02 13:27:33 -08:00
2011-01-09 16:26:51 -08:00
2008-07-05 21:25:39 -07:00
2010-12-20 21:33:00 -08:00
2010-12-01 18:09:13 -08:00
2010-04-23 23:35:28 -07:00
2010-11-10 12:12:00 -08:00
2008-10-29 01:41:45 -07:00
2009-10-07 16:39:43 -04:00
2009-12-09 19:43:33 -08:00
2009-11-06 14:32:24 +03:00
2010-11-28 11:12:20 -08:00
2010-04-22 16:12:36 -07:00
2010-12-10 14:43:58 -08:00
d503b30bd6