path: root/net/netfilter/nf_conntrack_core.c
diff options
authorPhil Oester <kernel@linuxace.com>2013-06-26 17:16:28 -0400
committerPablo Neira Ayuso <pablo@netfilter.org>2013-08-28 00:13:12 +0200
commitaffe759dbaa9e6c08b0da0a11d1933b61f199f51 (patch)
treef232ec8dcf549c3903b3a959480e79e9dba573c1 /net/netfilter/nf_conntrack_core.c
parent35fdb94b453bc69b7bc74b717f1e03d41d4bcdba (diff)
netfilter: ip[6]t_REJECT: tcp-reset using wrong MAC source if bridged
As reported by Casper Gripenberg, in a bridged setup, using ip[6]t_REJECT with the tcp-reset option sends out reset packets with the src MAC address of the local bridge interface, instead of the MAC address of the intended destination. This causes some routers/firewalls to drop the reset packet as it appears to be spoofed. Fix this by bypassing ip[6]_local_out and setting the MAC of the sender in the tcp reset packet. This closes netfilter bugzilla #531. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_core.c')
0 files changed, 0 insertions, 0 deletions