linux-kernel - Re: [Regression?] fib_rules: Added NLM_F_EXCL support to fib_nl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 2 Aug 2016 10:51:26 -0700
From:	John Stultz <john.stultz@...aro.org>
To:	David Ahern <dsa@...ulusnetworks.com>
Cc:	Lorenzo Colitti <lorenzo@...gle.com>,
	David Miller <davem@...emloft.net>,
	Mateusz Bajorski <mateusz.bajorski@...ia.com>,
	lkml <linux-kernel@...r.kernel.org>,
	Guodong Xu <guodong.xu@...aro.org>,
	Dmitry Shmidt <dimitrysh@...gle.com>,
	Chih-Hung Hsieh <chh@...gle.com>,
	Eric Caruso <ejcaruso@...gle.com>,
	Rom Lemarchand <romlem@...gle.com>
Subject: Re: [Regression?] fib_rules: Added NLM_F_EXCL support to
 fib_nl_newrule breaks Android userspace

On Tue, Aug 2, 2016 at 10:09 AM, David Ahern <dsa@...ulusnetworks.com> wrote:
> On 8/2/16 11:03 AM, John Stultz wrote:
>>
>> So bisecting between v4.7 and linus/HEAD with the test above, it seems
>> like:
>> 96c63fa7393d ("net: Add l3mdev rule")  is what breaks the tests.
>>
>> The l3mdev rule patch is a bit tangled with the fib_rules one, but if
>> I revert both of those, the only thing that fails is the
>> ./neighbour_test.py (which I need to dig further into). But those two
>> changes seem to be connected to the regression I'm seeing with
>> Android.
>
> That is surprising since the l3mdev rule should not exist on Android unless
> it has created a VRF.
>
> Does Android have custom FRA types in <linux/fib_rules.h>? Perhaps there is
> a collision on attribute number?

Sigh.

Yea, it looks like they do in their tree w/ their uid based routing:
https://android.googlesource.com/kernel/common.git/+/fd2cf795f3ab193752781be7372949ac1780d0ed%5E%21/

index 96161b8..ce19c5b 100644
--- a/include/uapi/linux/fib_rules.h
+++ b/include/uapi/linux/fib_rules.h
@@ -49,6 +49,8 @@ enum {
        FRA_TABLE,      /* Extended table id */
        FRA_FWMASK,     /* mask for netfilter mark */
        FRA_OIFNAME,
+       FRA_UID_START,  /* UID range */
+       FRA_UID_END,
        __FRA_MAX
 };

Without that change, networking would work with upstream kernels, but
now that new valid ids are upstream, their userspace is getting
confused.

Apologies for raising this as a regression.

Lorenzo/Rom: Fyi, you've got another upstream feature collision to work out.

thanks
-john