linux/net/ipv4/netfilter
Julian Anastasov ed6e4ef836 netfilter: Fix ip_route_me_harder triggering ip_rt_bug
Avoid creating input routes with ip_route_me_harder.
It does not work for locally generated packets. Instead,
restrict sockets to provide valid saddr for output route (or
unicast saddr for transparent proxy). For other traffic
allow saddr to be unicast or local but if callers forget
to check saddr type use 0 for the output route.

	The resulting handling should be:

- REJECT TCP:
	- in INPUT we can provide addr_type = RTN_LOCAL but
	better allow rejecting traffic delivered with
	local route (no IP address => use RTN_UNSPEC to
	allow also RTN_UNICAST).
	- FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
	saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
	- OUTPUT: RTN_UNSPEC

- NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT

- IPVS:
	- use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
	to restrict saddr to be local

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-29 05:47:32 -07:00
..
arp_tables.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 2011-04-19 11:24:06 -07:00
arpt_mangle.c
arptable_filter.c
ip_queue.c netfilter: fix looped (broad|multi)cast's MAC handling 2011-06-16 17:27:04 +02:00
ip_tables.c netfilter: ip_tables: fix compile with debug 2011-06-16 17:16:37 +02:00
ipt_ah.c
ipt_CLUSTERIP.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
ipt_ecn.c netfilter: ipt_ecn: fix inversion for IP header ECN match 2011-06-16 17:24:55 +02:00
ipt_ECN.c
ipt_LOG.c
ipt_MASQUERADE.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
ipt_NETMAP.c
ipt_REDIRECT.c
ipt_REJECT.c netfilter: Fix ip_route_me_harder triggering ip_rt_bug 2011-06-29 05:47:32 -07:00
ipt_ULOG.c
iptable_filter.c
iptable_mangle.c
iptable_raw.c
iptable_security.c
Kconfig netfilter: ipt_addrtype: rename to xt_addrtype 2011-03-15 20:16:20 +01:00
Makefile netfilter: ipt_addrtype: rename to xt_addrtype 2011-03-15 20:16:20 +01:00
nf_conntrack_l3proto_ipv4_compat.c
nf_conntrack_l3proto_ipv4.c netfilter: nf_nat: avoid double seq_adjust for loopback 2011-06-16 17:29:22 +02:00
nf_conntrack_proto_icmp.c netfilter: nf_conntrack: fix ct refcount leak in l4proto->error() 2011-06-06 01:37:02 +02:00
nf_defrag_ipv4.c
nf_nat_amanda.c
nf_nat_core.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_nat_ftp.c
nf_nat_h323.c
nf_nat_helper.c netfilter: nf_nat: fix crash in nf_nat_csum 2011-06-06 01:36:46 +02:00
nf_nat_irc.c
nf_nat_pptp.c
nf_nat_proto_common.c
nf_nat_proto_dccp.c
nf_nat_proto_gre.c
nf_nat_proto_icmp.c
nf_nat_proto_sctp.c
nf_nat_proto_tcp.c
nf_nat_proto_udp.c
nf_nat_proto_udplite.c
nf_nat_proto_unknown.c
nf_nat_rule.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_nat_sip.c
nf_nat_snmp_basic.c
nf_nat_standalone.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_nat_tftp.c