lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 4 Jun 2019 11:23:27 -0600 From: David Ahern <dsahern@...il.com> To: Tim Beale <timbeale@...alyst.net.nz>, netdev@...r.kernel.org Cc: davem@...emloft.net, kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org Subject: Re: [PATCH net] udp: only choose unbound UDP socket for multicast when not in a VRF On 6/3/19 7:56 PM, Tim Beale wrote: > By default, packets received in another VRF should not be passed to an > unbound socket in the default VRF. This patch updates the IPv4 UDP > multicast logic to match the unicast VRF logic (in compute_score()), > as well as the IPv6 mcast logic (in __udp_v6_is_mcast_sock()). > > The particular case I noticed was DHCP discover packets going > to the 255.255.255.255 address, which are handled by > __udp4_lib_mcast_deliver(). The previous code meant that running > multiple different DHCP server or relay agent instances across VRFs > did not work correctly - any server/relay agent in the default VRF > received DHCP discover packets for all other VRFs. > > Signed-off-by: Tim Beale <timbeale@...alyst.net.nz> > --- > net/ipv4/udp.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c > index 8fb250e..efe9283 100644 > --- a/net/ipv4/udp.c > +++ b/net/ipv4/udp.c > @@ -538,8 +538,7 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk, > (inet->inet_dport != rmt_port && inet->inet_dport) || > (inet->inet_rcv_saddr && inet->inet_rcv_saddr != loc_addr) || > ipv6_only_sock(sk) || > - (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && > - sk->sk_bound_dev_if != sdif)) > + !udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif)) > return false; > if (!ip_mc_sf_allow(sk, loc_addr, rmt_addr, dif, sdif)) > return false; > Thanks for the fix. Really should have been apart of this commit: Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") Reviewed-by: David Ahern <dsahern@...il.com> IPv6 mcast socket lookup was converted to udp_sk_bound_dev_eq, so v6 seems ok.
Powered by blists - more mailing lists