netdev - Re: [PATCH net] vrf: do not push non-ND strict packets with a source LLA through packet taps again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 20 Jun 2021 14:12:28 +0200
From:   Antoine Tenart <atenart@...nel.org>
To:     David Ahern <dsahern@...il.com>, davem@...emloft.net,
        dsahern@...nel.org, kuba@...nel.org
Cc:     netdev@...r.kernel.org, Stephen Suryaputra <ssuryaextr@...il.com>,
        Paolo Abeni <pabeni@...hat.com>, atenart@...nel.org
Subject: Re: [PATCH net] vrf: do not push non-ND strict packets with a source LLA through packet taps again

Quoting David Ahern (2021-06-19 03:18:50)
> On 6/18/21 9:15 AM, Antoine Tenart wrote:
> > --- a/drivers/net/vrf.c
> > +++ b/drivers/net/vrf.c
> > @@ -1366,22 +1366,22 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
> >       int orig_iif = skb->skb_iif;
> >       bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
> >       bool is_ndisc = ipv6_ndisc_frame(skb);
> > -     bool is_ll_src;
> >  
> >       /* loopback, multicast & non-ND link-local traffic; do not push through
> >        * packet taps again. Reset pkt_type for upper layers to process skb.
> > -      * for packets with lladdr src, however, skip so that the dst can be
> > -      * determine at input using original ifindex in the case that daddr
> > -      * needs strict
> > +      * For strict packets with a source LLA, determine the dst using the
> > +      * original ifindex.
> >        */
> > -     is_ll_src = ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL;
> > -     if (skb->pkt_type == PACKET_LOOPBACK ||
> > -         (need_strict && !is_ndisc && !is_ll_src)) {
> > +     if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
> >               skb->dev = vrf_dev;
> >               skb->skb_iif = vrf_dev->ifindex;
> >               IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
> > +
> >               if (skb->pkt_type == PACKET_LOOPBACK)
> >                       skb->pkt_type = PACKET_HOST;
> > +             else if (ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)
> > +                     vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
> > +
> >               goto out;
> >       }
> 
> you are basically moving Stephen's is_ll_src within the need_strict and
> not ND.

That's right.

> Did you run the fcnal-test script and verify no change in test results?

Yes, I saw no regression, and the tests Stephen added were still OK.

Antoine