lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 091/210] netfilter: nft_fib: Fix for rpath check with VRF devices
    Date
    From: Phil Sutter <phil@nwl.cc>

    [ Upstream commit 2a8a7c0eaa8747c16aa4a48d573aa920d5c00a5c ]

    Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
    dropping vrf packets by mistake") but for nftables fib expression:
    Add special treatment of VRF devices so that typical reverse path
    filtering via 'fib saddr . iif oif' expression works as expected.

    Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
    Signed-off-by: Phil Sutter <phil@nwl.cc>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/netfilter/nft_fib_ipv4.c | 3 +++
    net/ipv6/netfilter/nft_fib_ipv6.c | 6 +++++-
    2 files changed, 8 insertions(+), 1 deletion(-)

    diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
    index e50976e3c213..3b2e8ac45d4e 100644
    --- a/net/ipv4/netfilter/nft_fib_ipv4.c
    +++ b/net/ipv4/netfilter/nft_fib_ipv4.c
    @@ -95,6 +95,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
    else
    oif = NULL;

    + if (priv->flags & NFTA_FIB_F_IIF)
    + fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
    +
    if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
    nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
    nft_fib_store_result(dest, priv, pkt,
    diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
    index fd9a45cbd709..bcc673e433e6 100644
    --- a/net/ipv6/netfilter/nft_fib_ipv6.c
    +++ b/net/ipv6/netfilter/nft_fib_ipv6.c
    @@ -41,6 +41,9 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
    if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
    lookup_flags |= RT6_LOOKUP_F_IFACE;
    fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
    + } else if ((priv->flags & NFTA_FIB_F_IIF) &&
    + (netif_is_l3_master(dev) || netif_is_l3_slave(dev))) {
    + fl6->flowi6_oif = dev->ifindex;
    }

    if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)
    @@ -190,7 +193,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
    if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
    goto put_rt_err;

    - if (oif && oif != rt->rt6i_idev->dev)
    + if (oif && oif != rt->rt6i_idev->dev &&
    + l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
    goto put_rt_err;

    switch (priv->result) {
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 14:03    [W:2.186 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site