netdev - Re: [PATCH] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190424080214.vadrfiufcv6xa3cm@breakpoint.cc>
Date:   Wed, 24 Apr 2019 10:02:14 +0200
From:   Florian Westphal <fw@...len.de>
To:     linmiaohe <linmiaohe@...wei.com>
Cc:     pablo@...filter.org, kadlec@...ckhole.kfki.hu, dsahern@...il.com,
        davem@...emloft.net, yoshfuji@...ux-ipv6.org,
        netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, Mingfangsen <mingfangsen@...wei.com>
Subject: Re: [PATCH] net: netfilter: Fix ipv6 rp_filter dropping vrf packets
 by mistake

linmiaohe <linmiaohe@...wei.com> wrote:

[ CC dsa, dropped some CCs ]

> When firewall is enabled with rp_filter, vrf ipv6 packets
> will be dropped because in device is vrf but out device
> is an enslaved device. So rt->rt6i_idev->dev != dev and
> maybe return false in func rpfilter_lookup_reverse6.
> 
> Here is the out message when I ping the peer:
> ip vrf exec vrf1 ping 2013::2 -c 1
> 1 packets transmitted, 0 received, 100% packet loss, time 0ms
> 
> The drop info in /var/log/message:
> Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
> OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
> SRC=2013:0000:0000:0000:0000:0000:0000:0002
> DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
> FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
> 
> Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>
> ---
>  net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
> index c3c6b09acdc4..5cbc91f53736 100644
> --- a/net/ipv6/netfilter/ip6t_rpfilter.c
> +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
> @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
>  		goto out;
>  	}
> 
> +	if (netif_is_l3_master(dev)) {
> +		dev = __dev_get_by_index(dev_net(dev), IP6CB(skb)->iif);
> +		if (!dev)
> +			goto out;

I suspect this should be 'dev_get_by_index_rcu'.