The commit is pushed to "branch-rh7-3.10.0-1160.11.1.vz7.172.x-ovz" and will
appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.11.1.vz7.172.12
------>
commit 2f58ff85d1278516c32f66fc1c562b326499d0bb
Author: Liping Zhang <[email protected]>
Date: Fri Feb 5 14:31:51 2021 +0300
netfilter: nft_fib_ipv4: initialize *dest to zero
Otherwise, if fib lookup fail, *dest will be filled with garbage value,
so reverse path filtering will not work properly:
# nft add rule x prerouting fib saddr oif eq 0 drop
Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Liping Zhang <[email protected]>
Acked-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
https://jira.sw.ru/browse/PSBM-125002
(cherry picked from commit e0ffdbc78d84e1da090f03ab62da3def0e65159e)
Signed-off-by: Pavel Tikhomirov <[email protected]>
---
net/ipv4/netfilter/nft_fib_ipv4.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c
b/net/ipv4/netfilter/nft_fib_ipv4.c
index 976a73b..1c82b94a 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -122,6 +122,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct
nft_regs *regs,
fl4.saddr = get_saddr(iph->daddr);
}
+ *dest = 0;
+
if (fib_lookup(nft_net(pkt), &fl4, &res))
return;
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
