netdev - Re: [PATCH net-next v2 1/1] net: Allow a rule to track originating protocol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Feb 2018 10:20:22 -0700
From:   David Ahern <dsahern@...il.com>
To:     Ido Schimmel <idosch@...sch.org>,
        Donald Sharp <sharpd@...ulusnetworks.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net-next v2 1/1] net: Allow a rule to track originating
 protocol

On 2/22/18 1:23 AM, Ido Schimmel wrote:
>> diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
>> index 98e1066c3d55..c1d4ab5b2d9f 100644
>> --- a/net/core/fib_rules.c
>> +++ b/net/core/fib_rules.c
>> @@ -51,6 +51,7 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
>>  	r->pref = pref;
>>  	r->table = table;
>>  	r->flags = flags;
>> +	r->proto = RTPROT_KERNEL;
>>  	r->fr_net = ops->fro_net;
>>  	r->uid_range = fib_kuid_range_unset;
>>  
>> @@ -465,6 +466,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
>>  	}
>>  	refcount_set(&rule->refcnt, 1);
>>  	rule->fr_net = net;
>> +	rule->proto = frh->proto;
>>  
>>  	rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
>>  	                              : fib_default_rule_pref(ops);
>> @@ -664,6 +666,9 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
>>  	}
>>  
>>  	list_for_each_entry(rule, &ops->rules_list, list) {
>> +		if (frh->proto && (frh->proto != rule->proto))
>> +			continue;
> 
> This breaks my scripts:
> # ip -4 rule show
> 0:      from all lookup local
> 32766:  from all lookup main
> 32767:  from all lookup default
> 
> # ip -4 rule del pref 0
> RTNETLINK answers: No such file or directory
> 
> Using iproute 4.15 in Fedora 27:
> # ip -V
> ip utility, iproute2-ss180129
> 
> Problem is iproute sets protocol to RTPROT_BOOT while rules are
> installed with RTPROT_KERNEL.
> 
> Maybe add FRA_PROTOCOL?
> 
> Thanks!

ugh. Another iproute2 bug that the kernel has to deal with. iproute2 has
been using rtm for the ancillary header for rules when it should have
been fib_rule_hdr. That bug allowed someone to set the protocol field to
RTPROT_BOOT which was complete nonsense for rules until Donald's recent
patch.

That means all FIB rules need to default to RTPROT_BOOT. I hate to
inherit that for the l3mdev rule, but looking at the iproute2 code I
don't see any options.

Donald: send a patch that changes the protocol for kernel installed
rules to RTPROT_BOOT.