netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too
authorFlorian Westphal <fw@strlen.de>
Wed, 17 Apr 2013 22:45:24 +0000 (22:45 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 18 Apr 2013 22:11:59 +0000 (00:11 +0200)
commitf83a7ea2075ca896f2dbf07672bac9cf3682ff74
treece21e50675072ee54018788ddea8b234daad4af4
parent5add189a125e6b497e31bffdaaed8145ec6d4984
netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too

Alex Efros reported rpfilter module doesn't match following packets:
IN=br.qemu SRC=192.168.2.1 DST=192.168.2.255 [ .. ]
(netfilter bugzilla #814).

Problem is that network stack arranges for the locally generated broadcasts
to appear on the interface they were sent out, so the IFF_LOOPBACK check
doesn't trigger.

As -m rpfilter is restricted to PREROUTING, we can check for existing
rtable instead, it catches locally-generated broad/multicast case, too.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/ipt_rpfilter.c
net/ipv6/netfilter/ip6t_rpfilter.c