@@ -78,6 +78,7 @@
#include <linux/inet.h>
#include <linux/ipv6.h>
+#include <linux/netfilter.h>
#include <linux/stddef.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
@@ -1594,6 +1595,15 @@ int tcp_v4_rcv(struct sk_buff *skb)
if (!sk)
goto no_tcp_socket;
+ if (unlikely(skb->nf_postponed)) {
+ ret = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_IN, sk,
+ skb, skb->dev, NULL, NULL);
+ if (ret != 1) {
+ sock_put(sk);
+ return 0;
+ }
+ }
+
process:
if (sk->sk_state == TCP_TIME_WAIT)
goto do_time_wait;
When an skb has been marked for later re-iteration through netfilter, do that after __inet_lookup_skb() has been called. This allows packets sent to unconnected sockets to be filtered reliably. Note that this will never happen for subsequent packets in the same stream, as skb->sk will be set due to early demux, and hence skb->nf_postponed will remain 0. Signed-off-by: Daniel Mack <daniel@zonque.org> --- net/ipv4/tcp_ipv4.c | 10 ++++++++++ 1 file changed, 10 insertions(+)