nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

netfilter: rpfilter/fib: Populate flowic_l3mdev field

Browse source 
Use the introduced field for correct operation with VRF devices instead
of conditionally overwriting flowic_oif. This is a partial revert of
commit b575b24b8e ("netfilter: Fix rpfilter dropping vrf packets by
mistake"), implementing a simpler solution.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Phil Sutter 2022-10-05 18:07:05 +02:00 committed by Florian Westphal
parent 6e31ce831c
commit acc641ab95
4 changed files with 7 additions and 11 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
net/ipv4/netfilter/ipt_rpfilter.c
View file

@ -77,7 +77,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
flow.flowi4_scope = RT_SCOPE_UNIVERSE; flow.flowi4_scope = RT_SCOPE_UNIVERSE;
flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par));
return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
} }

2
net/ipv4/netfilter/nft_fib_ipv4.c
View file

@ -84,7 +84,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
oif = NULL; oif = NULL;
if (priv->flags & NFTA_FIB_F_IIF) if (priv->flags & NFTA_FIB_F_IIF)
fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif); fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(oif);
if (nft_hook(pkt) == NF_INET_PRE_ROUTING && if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
nft_fib_is_loopback(pkt->skb, nft_in(pkt))) { nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {

9
net/ipv6/netfilter/ip6t_rpfilter.c
View file

@ -37,6 +37,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
bool ret = false; bool ret = false;
struct flowi6 fl6 = { struct flowi6 fl6 = {
.flowi6_iif = LOOPBACK_IFINDEX, .flowi6_iif = LOOPBACK_IFINDEX,
.flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev),
.flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK, .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
.flowi6_proto = iph->nexthdr, .flowi6_proto = iph->nexthdr,
.daddr = iph->saddr, .daddr = iph->saddr,
@ -55,9 +56,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
if (rpfilter_addr_linklocal(&iph->saddr)) { if (rpfilter_addr_linklocal(&iph->saddr)) {
lookup_flags |= RT6_LOOKUP_F_IFACE; lookup_flags |= RT6_LOOKUP_F_IFACE;
fl6.flowi6_oif = dev->ifindex; fl6.flowi6_oif = dev->ifindex;
/* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */ } else if ((flags & XT_RPFILTER_LOOSE) == 0)
} else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) ||
(flags & XT_RPFILTER_LOOSE) == 0)
fl6.flowi6_oif = dev->ifindex; fl6.flowi6_oif = dev->ifindex;
rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
@ -72,9 +71,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
goto out; goto out;
} }
if (rt->rt6i_idev->dev == dev || if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex ||
(flags & XT_RPFILTER_LOOSE))
ret = true; ret = true;
out: out:
ip6_rt_put(rt); ip6_rt_put(rt);

5
net/ipv6/netfilter/nft_fib_ipv6.c
View file

@ -41,9 +41,8 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) { if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
lookup_flags |= RT6_LOOKUP_F_IFACE; lookup_flags |= RT6_LOOKUP_F_IFACE;
fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev); fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
} else if ((priv->flags & NFTA_FIB_F_IIF) && } else if (priv->flags & NFTA_FIB_F_IIF) {
(netif_is_l3_master(dev) || netif_is_l3_slave(dev))) { fl6->flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev);
fl6->flowi6_oif = dev->ifindex;
} }
if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST) if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)