Commit 04295878 authored by Jan Engelhardt's avatar Jan Engelhardt Committed by Pablo Neira Ayuso
Browse files

netfilter: use actual socket sk for REJECT action 



True to the message of commit v5.10-rc1-105-g46d6c5ae953c, _do_
actually make use of state->sk when possible, such as in the REJECT
modules.

Reported-by: default avatarMinqiang Chen <ptpt52@gmail.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarJan Engelhardt <jengelh@inai.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f7583f02

include/net/netfilter/ipv4/nf_reject.h

+2 −2
Original line number Diff line number Diff line
@@ -8,8 +8,8 @@ 
#include <net/netfilter/nf_reject.h>



void nf_send_unreach(struct sk_buff *skb_in, int code, int hook);

void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook);



void nf_send_reset(struct net *net, struct sock *, struct sk_buff *oldskb,

		   int hook);

const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,

					     struct tcphdr *_oth, int hook);

struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,

include/net/netfilter/ipv6/nf_reject.h

+2 −3
Original line number Diff line number Diff line
@@ -7,9 +7,8 @@ 


void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, unsigned char code,

		      unsigned int hooknum);



void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook);



void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,

		    int hook);

const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb,

					      struct tcphdr *otcph,

					      unsigned int *otcplen, int hook);

net/ipv4/netfilter/ipt_REJECT.c

+2 −1
Original line number Diff line number Diff line
@@ -56,7 +56,8 @@ reject_tg(struct sk_buff *skb, const struct xt_action_param *par) 
		nf_send_unreach(skb, ICMP_PKT_FILTERED, hook);

		break;

	case IPT_TCP_RESET:

		nf_send_reset(xt_net(par), skb, hook);

		nf_send_reset(xt_net(par), par->state->sk, skb, hook);

		break;

	case IPT_ICMP_ECHOREPLY:

		/* Doesn't happen. */

		break;

net/ipv4/netfilter/nf_reject_ipv4.c

+3 −3
Original line number Diff line number Diff line
@@ -234,7 +234,8 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in) 
}



/* Send RST reply */

void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)

void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,

		   int hook)

{

	struct net_device *br_indev __maybe_unused;

	struct sk_buff *nskb;
@@ -267,8 +268,7 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) 
	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,

				   ip4_dst_hoplimit(skb_dst(nskb)));

	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);



	if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC))

	if (ip_route_me_harder(net, sk, nskb, RTN_UNSPEC))

		goto free_nskb;



	niph = ip_hdr(nskb);

net/ipv4/netfilter/nft_reject_ipv4.c

+2 −1
Original line number Diff line number Diff line
@@ -27,7 +27,8 @@ static void nft_reject_ipv4_eval(const struct nft_expr *expr, 
		nf_send_unreach(pkt->skb, priv->icmp_code, nft_hook(pkt));

		break;

	case NFT_REJECT_TCP_RST:

		nf_send_reset(nft_net(pkt), pkt->skb, nft_hook(pkt));

		nf_send_reset(nft_net(pkt), pkt->xt.state->sk, pkt->skb,

			      nft_hook(pkt));

		break;

	default:

		break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE