aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDmitry Popov2013-04-11 03:55:07 -0500
committerGreg Kroah-Hartman2013-05-01 11:46:18 -0500
commit709e7eba68f1412073a6c03771ba2b656576128d (patch)
treec6647895f3b3fa475b39c28320d90a39d115cd0c /net
parentec7491c1c7f3176569f9e8e097945db980189673 (diff)
downloadkernel-video-709e7eba68f1412073a6c03771ba2b656576128d.tar.gz
kernel-video-709e7eba68f1412073a6c03771ba2b656576128d.tar.xz
kernel-video-709e7eba68f1412073a6c03771ba2b656576128d.zip
tcp: incoming connections might use wrong route under synflood
[ Upstream commit d66954a066158781ccf9c13c91d0316970fe57b6 ] There is a bug in cookie_v4_check (net/ipv4/syncookies.c): flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP, inet_sk_flowi_flags(sk), (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, ireq->loc_addr, th->source, th->dest); Here we do not respect sk->sk_bound_dev_if, therefore wrong dst_entry may be taken. This dst_entry is used by new socket (get_cookie_sock -> tcp_v4_syn_recv_sock), so its packets may take the wrong path. Signed-off-by: Dmitry Popov <dp@highloadlab.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/syncookies.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b236ef04914..f962f19dabe 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -348,8 +348,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
348 * hasn't changed since we received the original syn, but I see 348 * hasn't changed since we received the original syn, but I see
349 * no easy way to do this. 349 * no easy way to do this.
350 */ 350 */
351 flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), 351 flowi4_init_output(&fl4, sk->sk_bound_dev_if, sk->sk_mark,
352 RT_SCOPE_UNIVERSE, IPPROTO_TCP, 352 RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
353 inet_sk_flowi_flags(sk), 353 inet_sk_flowi_flags(sk),
354 (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, 354 (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
355 ireq->loc_addr, th->source, th->dest); 355 ireq->loc_addr, th->source, th->dest);