netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too
authorFlorian Westphal <fw@strlen.de>
Wed, 17 Apr 2013 22:45:24 +0000 (22:45 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 18 Apr 2013 22:11:59 +0000 (00:11 +0200)
Alex Efros reported rpfilter module doesn't match following packets:
IN=br.qemu SRC=192.168.2.1 DST=192.168.2.255 [ .. ]
(netfilter bugzilla #814).

Problem is that network stack arranges for the locally generated broadcasts
to appear on the interface they were sent out, so the IFF_LOOPBACK check
doesn't trigger.

As -m rpfilter is restricted to PREROUTING, we can check for existing
rtable instead, it catches locally-generated broad/multicast case, too.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

No differences found