netdev - Re: [PATCH net] ipvlan: fix bound dev checking for IPv6 l3s mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 08 Jun 2023 10:46:47 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Hangbin Liu <liuhangbin@...il.com>, netdev@...r.kernel.org
Cc: David Ahern <dsa@...ulusnetworks.com>, Jianguo Wu
 <wujianguo@...natelecom.cn>, Daniel Borkmann <daniel@...earbox.net>, Mahesh
 Bandewar <maheshb@...gle.com>
Subject: Re: [PATCH net] ipvlan: fix bound dev checking for IPv6 l3s mode

On Wed, 2023-06-07 at 16:45 +0800, Hangbin Liu wrote:
> The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s
> mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix
> works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which
> is skb->skb_iif when there is no route.
> 
> But for IPv6, the fix is not enough, because in ipv6_raw_deliver() ->
> raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif
> instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part
> issue. Let's set IP6SKB_L3SLAVE flag for ipvlan l3s input packets.
> 
> Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes")
> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2196710
> Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
> ---
> I'm not 100% sure if we can use IP6SKB_L3SLAVE flag for ipvlan. 

I'm unsure either ;) Especially for a -net patch, as the implication on
later stack processing are fairly not trivial to me.

What about instead just setting IP6CB(skb)->iif for ipv6 packets?

Side notes we could possibly use nf hooks for ipv4 and ipv6

Thanks!

Paolo