netdev - Re: [PATCH net,v2] vrf: check forwarding on the original netdevice when generating ICMP dest unreachable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4405cafd-8736-ccc3-ac00-5c804c9756a4@gmail.com>
Date:   Wed, 28 Feb 2018 10:39:48 -0700
From:   David Ahern <dsahern@...il.com>
To:     Stephen Suryaputra <ssuryaextr@...il.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net,v2] vrf: check forwarding on the original netdevice
 when generating ICMP dest unreachable

On 2/28/18 9:55 AM, Stephen Suryaputra wrote:
> The concern only applies when the skb->dev is an l3mdev master, right?
> After I sent v2, I'm worried that rt shouldn't be derefrenced if
> in_dev is NULL. Even though I think it should be ok, it's better to
> keep the original execution order. So, how about this before I put
> another patch? The net for the iif is derived from skb->dev.
> 
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index a4f44d8..9a29225 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -930,14 +930,23 @@ void ip_rt_send_redirect(struct sk_buff *skb)
> 
>  static int ip_error(struct sk_buff *skb)
>  {
> -       struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
>         struct rtable *rt = skb_rtable(skb);
> +       struct net_device *dev = skb->dev;
> +       struct in_device *in_dev;
>         struct inet_peer *peer;
>         unsigned long now;
>         struct net *net;
>         bool send;
>         int code;
> 
> +       if (netif_is_l3_master(skb->dev)) {
> +               dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
> +               if (!dev)
> +                       goto out;
> +       }
> +
> +       in_dev = __in_dev_get_rcu(dev);
> +
>         /* IP on this device is disabled. */
>         if (!in_dev)
>                 goto out;
> 

Using dev_net from skb is fine, preferable really since the real ingress
device and the VRF device have to be in the same network namespace.