netdev - [PATCH net] ipvlan: fix bound dev checking for IPv6 l3s mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed,  7 Jun 2023 16:45:30 +0800
From: Hangbin Liu <liuhangbin@...il.com>
To: netdev@...r.kernel.org
Cc: David Ahern <dsa@...ulusnetworks.com>,
	Jianguo Wu <wujianguo@...natelecom.cn>,
	Daniel Borkmann <daniel@...earbox.net>,
	Mahesh Bandewar <maheshb@...gle.com>,
	Hangbin Liu <liuhangbin@...il.com>
Subject: [PATCH net] ipvlan: fix bound dev checking for IPv6 l3s mode

The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s
mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix
works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which
is skb->skb_iif when there is no route.

But for IPv6, the fix is not enough, because in ipv6_raw_deliver() ->
raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif
instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part
issue. Let's set IP6SKB_L3SLAVE flag for ipvlan l3s input packets.

Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2196710
Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
---
I'm not 100% sure if we can use IP6SKB_L3SLAVE flag for ipvlan. But since
the l3s mode is a part of l3mdev enhancements. I assume it should be OK.

BTW, the fixes tag also looks not fit enough. The ipvlan_nf_input() is already
there in commit c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from
other modes"). I think we should use 4fbae7d83c98 ("ipvlan: Introduce l3s
mode"). But I would keep using c675e06a98a4 as a consistence of the IPv4
version fix if no object.
---
 drivers/net/ipvlan/ipvlan_l3s.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c
index 71712ea25403..df675d9d2f21 100644
--- a/drivers/net/ipvlan/ipvlan_l3s.c
+++ b/drivers/net/ipvlan/ipvlan_l3s.c
@@ -100,6 +100,11 @@ static unsigned int ipvlan_nf_input(void *priv, struct sk_buff *skb,
 	if (!addr)
 		goto out;
 
+#if IS_ENABLED(CONFIG_IPV6)
+	if (addr->atype == IPVL_IPV6)
+		IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
+#endif
+
 	skb->dev = addr->master->dev;
 	skb->skb_iif = skb->dev->ifindex;
 	len = skb->len + ETH_HLEN;
-- 
2.38.1