netfilter: tproxy: do not assign timewait sockets to skb->sk
Assigning a socket in timewait state to skb->sk can trigger kernel oops, e.g. in nfnetlink_log, which does: if (skb->sk) { read_lock_bh(&skb->sk->sk_callback_lock); if (skb->sk->sk_socket && skb->sk->sk_socket->file) ... in the timewait case, accessing sk->sk_callback_lock and sk->sk_socket is invalid. Either all of these spots will need to add a test for sk->sk_state != TCP_TIME_WAIT, or xt_TPROXY must not assign a timewait socket to skb->sk. This does the latter. If a TW socket is found, assign the tproxy nfmark, but skip the skb->sk assignment, thus mimicking behaviour of a '-m socket .. -j MARK/ACCEPT' re-routing rule. The 'SYN to TW socket' case is left unchanged -- we try to redirect to the listener socket. Cc: Balazs Scheidler <bazsi@balabit.hu> Cc: KOVACS Krisztian <hidden@balabit.hu> Signed-off-by:Florian Westphal <fwestphal@astaro.com> Signed-off-by:
Patrick McHardy <kaber@trash.net>
Showing
- include/net/netfilter/nf_tproxy_core.h 1 addition, 11 deletionsinclude/net/netfilter/nf_tproxy_core.h
- net/netfilter/nf_tproxy_core.c 12 additions, 15 deletionsnet/netfilter/nf_tproxy_core.c
- net/netfilter/xt_TPROXY.c 20 additions, 2 deletionsnet/netfilter/xt_TPROXY.c
- net/netfilter/xt_socket.c 11 additions, 2 deletionsnet/netfilter/xt_socket.c
Loading