[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <71a20e24-10e8-42a8-8509-7e704aff9c5c@redhat.com>
Date: Mon, 21 Oct 2024 12:20:32 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Menglong Dong <menglong8.dong@...il.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
dsahern@...nel.org, pablo@...filter.org, kadlec@...filter.org,
roopa@...dia.com, razor@...ckwall.org, gnault@...hat.com,
bigeasy@...utronix.de, idosch@...dia.com, ast@...nel.org,
dongml2@...natelecom.cn, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, netfilter-devel@...r.kernel.org,
coreteam@...filter.org, bridge@...ts.linux.dev, bpf@...r.kernel.org
Subject: Re: [PATCH net-next v3 02/10] net: ip: make fib_validate_source()
return drop reason
On 10/15/24 16:07, Menglong Dong wrote:
> diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
> index 90ff815f212b..b3f7a1562140 100644
> --- a/include/net/ip_fib.h
> +++ b/include/net/ip_fib.h
> @@ -452,13 +452,16 @@ int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
> dscp_t dscp, int oif, struct net_device *dev,
> struct in_device *idev, u32 *itag);
>
> -static inline int
> +static inline enum skb_drop_reason
> fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
> dscp_t dscp, int oif, struct net_device *dev,
> struct in_device *idev, u32 *itag)
> {
> - return __fib_validate_source(skb, src, dst, dscp, oif, dev, idev,
> - itag);
> + int err = __fib_validate_source(skb, src, dst, dscp, oif, dev, idev,
> + itag);
> + if (err < 0)
> + return -err;
> + return SKB_NOT_DROPPED_YET;
> }
It looks like the code churn in patch 1 is not needed??? You could just
define here a fib_validate_source_reason() helper doing the above, and
replace fib_validate_source with the the new helper as needed. Would
that work?
> @@ -1785,9 +1785,10 @@ static int __mkroute_input(struct sk_buff *skb, const struct fib_result *res,
> return -EINVAL;
> }
>
> - err = fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res),
> - in_dev->dev, in_dev, &itag);
> + err = __fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res),
> + in_dev->dev, in_dev, &itag);
> if (err < 0) {
> + err = -EINVAL;
> ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
> saddr);
I'm sorry for not noticing this issue before, but must preserve (at
least) the -EXDEV error code from the unpatched version or RP Filter MIB
accounting in ip_rcv_finish_core() will be fooled.
Thanks,
Paolo
Powered by blists - more mailing lists