Re: [PATCH v2] ip_forward: Drop frames with attached skb->sk

2015-04-20 Thread David Miller
From: Sebastian Poehn Date: Mon, 20 Apr 2015 09:19:20 +0200 > Initial discussion was: > [FYI] xfrm: Don't lookup sk_policy for timewait sockets > > Forwarded frames should not have a socket attached. Especially > tw sockets will lead to panics later-on in the stack. > > This was observed with T

[PATCH v2] ip_forward: Drop frames with attached skb->sk

2015-04-20 Thread Sebastian Poehn
Initial discussion was: [FYI] xfrm: Don't lookup sk_policy for timewait sockets Forwarded frames should not have a socket attached. Especially tw sockets will lead to panics later-on in the stack. This was observed with TPROXY assigning a tw socket and broken policy routing (misconfigured). As a