netdev - Re: [PATCH net] vrf: do not push non-ND strict packets with a source LLA through packet taps again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 20 Jun 2021 21:20:01 -0600
From:   David Ahern <dsahern@...il.com>
To:     Antoine Tenart <atenart@...nel.org>, davem@...emloft.net,
        dsahern@...nel.org, kuba@...nel.org
Cc:     netdev@...r.kernel.org, Stephen Suryaputra <ssuryaextr@...il.com>,
        Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH net] vrf: do not push non-ND strict packets with a source
 LLA through packet taps again

On 6/20/21 6:12 AM, Antoine Tenart wrote:
> Quoting David Ahern (2021-06-19 03:18:50)
>> On 6/18/21 9:15 AM, Antoine Tenart wrote:
>>> --- a/drivers/net/vrf.c
>>> +++ b/drivers/net/vrf.c
>>> @@ -1366,22 +1366,22 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
>>>       int orig_iif = skb->skb_iif;
>>>       bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
>>>       bool is_ndisc = ipv6_ndisc_frame(skb);
>>> -     bool is_ll_src;
>>>  
>>>       /* loopback, multicast & non-ND link-local traffic; do not push through
>>>        * packet taps again. Reset pkt_type for upper layers to process skb.
>>> -      * for packets with lladdr src, however, skip so that the dst can be
>>> -      * determine at input using original ifindex in the case that daddr
>>> -      * needs strict
>>> +      * For strict packets with a source LLA, determine the dst using the
>>> +      * original ifindex.
>>>        */
>>> -     is_ll_src = ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL;
>>> -     if (skb->pkt_type == PACKET_LOOPBACK ||
>>> -         (need_strict && !is_ndisc && !is_ll_src)) {
>>> +     if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
>>>               skb->dev = vrf_dev;
>>>               skb->skb_iif = vrf_dev->ifindex;
>>>               IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
>>> +
>>>               if (skb->pkt_type == PACKET_LOOPBACK)
>>>                       skb->pkt_type = PACKET_HOST;
>>> +             else if (ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)
>>> +                     vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
>>> +
>>>               goto out;
>>>       }
>>
>> you are basically moving Stephen's is_ll_src within the need_strict and
>> not ND.
> 
> That's right.
> 
>> Did you run the fcnal-test script and verify no change in test results?
> 
> Yes, I saw no regression, and the tests Stephen added were still OK.
> 
> Antoine
> 

Reviewed-by: David Ahern <dsahern@...nel.org>