• Julian Anastasov's avatar
    netfilter: TCP and raw fix for ip_route_me_harder · 01866066
    Julian Anastasov authored
    [ Upstream commit 797fd391 ]
    
    TCP in some cases uses different global (raw) socket
    to send RST and ACK. The transparent flag is not set there.
    Currently, it is a problem for rerouting after the previous
    change.
    
    	Fix it by simplifying the checks in ip_route_me_harder
    and use FLOWI_FLAG_ANYSRC even for sockets. It looks safe
    because the initial routing allowed this source address to
    be used and now we just have to make sure the packet is rerouted.
    
    	As a side effect this also allows rerouting for normal
    raw sockets that use spoofed source addresses which was not possible
    even before we eliminated the ip_route_input call.
    Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
    01866066
netfilter.c 6.18 KB