netfilter: rpfilter: bypass ipv4 lbcast packets with zeronet source

Otherwise, DHCP Discover packets(0.0.0.0->255.255.255.255) may be
dropped incorrectly.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 59b49945b48103d25b885f1827d5479044e10e57..f273098e48fd5bbe0ffb95c0daeb315c3a6f06f1 100644 (file)
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -83,10 +83,12 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
                return true ^ invert;
 
        iph = ip_hdr(skb);
-       if (ipv4_is_multicast(iph->daddr)) {
-               if (ipv4_is_zeronet(iph->saddr))
-                       return ipv4_is_local_multicast(iph->daddr) ^ invert;
+       if (ipv4_is_zeronet(iph->saddr)) {
+               if (ipv4_is_lbcast(iph->daddr) ||
+                   ipv4_is_local_multicast(iph->daddr))
+                       return true ^ invert;
        }
+
        flow.flowi4_iif = LOOPBACK_IFINDEX;
        flow.daddr = iph->saddr;
        flow.saddr = rpfilter_get_saddr(iph->daddr);

diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index 258136364f5ef8938e74ce7bbc88f6f65b9529ac..965b1a161369323e37dd5f103c34cbc3e4e901b5 100644 (file)
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -101,12 +101,13 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
        }
 
        iph = ip_hdr(pkt->skb);
-       if (ipv4_is_multicast(iph->daddr) &&
-           ipv4_is_zeronet(iph->saddr) &&
-           ipv4_is_local_multicast(iph->daddr)) {
-               nft_fib_store_result(dest, priv->result, pkt,
-                                    get_ifindex(pkt->skb->dev));
-               return;
+       if (ipv4_is_zeronet(iph->saddr)) {
+               if (ipv4_is_lbcast(iph->daddr) ||
+                   ipv4_is_local_multicast(iph->daddr)) {
+                       nft_fib_store_result(dest, priv->result, pkt,
+                                            get_ifindex(pkt->skb->dev));
+                       return;
+               }
        }
 
        if (priv->flags & NFTA_FIB_F_MARK)