netdev - Re: [PATCH net-next v4 3/9] net: ensure unbound datagram socket to be chosen when not in a VRF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Nov 2018 10:59:45 -0700
From:   David Ahern <dsahern@...il.com>
To:     Mike Manning <mmanning@...tta.att-mail.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next v4 3/9] net: ensure unbound datagram socket to be
 chosen when not in a VRF

On 11/2/18 1:10 PM, Mike Manning wrote:
> diff --git a/include/net/udp.h b/include/net/udp.h
> index 9e82cb391dea..057972d0eea5 100644
> --- a/include/net/udp.h
> +++ b/include/net/udp.h
> @@ -252,6 +252,17 @@ static inline int udp_rqueue_get(struct sock *sk)
>  	return sk_rmem_alloc_get(sk) - READ_ONCE(udp_sk(sk)->forward_deficit);
>  }
>  
> +static inline bool udp_sk_bound_dev_eq(struct net *net, int bound_dev_if,
> +				       int dif, int sdif)
> +{
> +#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
> +	return inet_bound_dev_eq(net->ipv4.sysctl_udp_l3mdev_accept,

!!net->ipv4.sysctl_udp_l3mdev_accept since first arg is a bool

> +				 bound_dev_if, dif, sdif);
> +#else
> +	return inet_bound_dev_eq(1, bound_dev_if, dif, sdif);
> +#endif
> +}
> +
>  /* net/ipv4/udp.c */
>  void udp_destruct_sock(struct sock *sk);
>  void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len);

...

> diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
> index 1ede7a16a0be..4813293d4fad 100644
> --- a/net/ipv6/datagram.c
> +++ b/net/ipv6/datagram.c
> @@ -782,7 +782,10 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
>  
>  			if (src_info->ipi6_ifindex) {
>  				if (fl6->flowi6_oif &&
> -				    src_info->ipi6_ifindex != fl6->flowi6_oif)
> +				    src_info->ipi6_ifindex != fl6->flowi6_oif &&
> +				    (sk->sk_bound_dev_if != fl6->flowi6_oif ||
> +				     !sk_dev_equal_l3scope(
> +					     sk, src_info->ipi6_ifindex)))

That's getting ugly to read. A tmp variable
	int idx = rc_info->ipi6_ifindex;
should shorten that to fit on one line.

>  					return -EINVAL;
>  				fl6->flowi6_oif = src_info->ipi6_ifindex;
>  			}