tcp: Add a tcp_filter hook before handle ack packet

Browse source

Currently in both ipv4 and ipv6 code path, the ack packet received when
sk at TCP_NEW_SYN_RECV state is not filtered by socket filter or cgroup
filter since it is handled from tcp_child_process and never reaches the
tcp_filter inside tcp_v4_rcv or tcp_v6_rcv. Adding a tcp_filter hooks
here can make sure all the ingress tcp packet can be correctly filtered.

Signed-off-by: Chenbo Feng <fengc@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Chenbo Feng 2017-06-20 19:06:40 -07:00 • committed by David S. Miller

parent 2da55390a9

commit 8fac365f63

2 changed files with 4 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

net/ipv4/tcp_ipv4.c

View file

2

net/ipv6/tcp_ipv6.c

View file