| commit | e1dbbc5907b53d8d53c009b3cb3dd2a0366ce45c | |
| author | Liping Zhang <liping.zhang@spreadtrum.com> | |
| Mon, 20 Jun 2016 13:26:28 +0000 (20 21:26 +0800) | ||
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | |
| Fri, 24 Jun 2016 09:03:22 +0000 (24 11:03 +0200) | ||
| tree | 19334e637adb37e43907f23d79fd9bfcc305ac90 | treesnapshot (tar.gz zip) |
| parent | 9847371a84b0be330f4bc4aaa98904101ee8573d | commitdiff |
netfilter: nf_reject_ipv4: don't send tcp RST if the packet is non-TCP
In iptables, if the user add a rule to send tcp RST and specify the
non-TCP protocol, such as UDP, kernel will reject this request. But
in nftables, this validity check only occurs in nft tool, i.e. only
in userspace.
This means that user can add such a rule like follows via nfnetlink:
"nft add rule filter forward ip protocol udp reject with tcp reset"
This will generate some confusing tcp RST packets. So we should send
tcp RST only when it is TCP packet.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
In iptables, if the user add a rule to send tcp RST and specify the
non-TCP protocol, such as UDP, kernel will reject this request. But
in nftables, this validity check only occurs in nft tool, i.e. only
in userspace.
This means that user can add such a rule like follows via nfnetlink:
"nft add rule filter forward ip protocol udp reject with tcp reset"
This will generate some confusing tcp RST packets. So we should send
tcp RST only when it is TCP packet.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| net/ipv4/netfilter/nf_reject_ipv4.c | diffblobblamehistory |