Re: [PATCH] netfilter: xt_socket: fix transparent match for IPv6 request sockets

2016-09-25 Thread Pablo Neira Ayuso
On Fri, Sep 23, 2016 at 11:27:42AM +0200, KOVACS Krisztian wrote: > The introduction of TCP_NEW_SYN_RECV state, and the addition of request > sockets to the ehash table seems to have broken the --transparent option > of the socket match for IPv6 (around commit a9407000). > > Now that the socket

Re: [PATCH] netfilter: xt_socket: fix transparent match for IPv6 request sockets

2016-09-20 Thread Eric Dumazet
On Tue, 2016-09-20 at 08:01 -0700, Eric Dumazet wrote: > > Something like : > > diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c > index 3ebf45b38bc3..0fccfd6cc258 100644 > --- a/net/ipv4/tcp_input.c > +++ b/net/ipv4/tcp_input.c > @@ -6264,6 +6264,7 @@ int tcp_conn_request(struct

Re: [PATCH] netfilter: xt_socket: fix transparent match for IPv6 request sockets

2016-09-20 Thread Eric Dumazet
On Tue, 2016-09-20 at 15:26 +0200, KOVACS Krisztian wrote: > The introduction of TCP_NEW_SYN_RECV state, and the addition of request > sockets to the ehash table seems to have broken the --transparent option > of the socket match for IPv6 (around commit a9407000). > > Now that the socket lookup

[PATCH] netfilter: xt_socket: fix transparent match for IPv6 request sockets

2016-09-20 Thread KOVACS Krisztian
The introduction of TCP_NEW_SYN_RECV state, and the addition of request sockets to the ehash table seems to have broken the --transparent option of the socket match for IPv6 (around commit a9407000). Now that the socket lookup finds the TCP_NEW_SYN_RECV socket instead of the listener, the