netdev - Re: [PATCHv2 net] ipvlan: fix bound dev checking for IPv6 l3s mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 9 Jun 2023 17:40:29 +0200
From: Larysa Zaremba <larysa.zaremba@...el.com>
To: Hangbin Liu <liuhangbin@...il.com>
CC: <netdev@...r.kernel.org>, David Ahern <dsahern@...nel.org>, "Daniel
 Borkmann" <daniel@...earbox.net>, Mahesh Bandewar <maheshb@...gle.com>,
	"Paolo Abeni" <pabeni@...hat.com>
Subject: Re: [PATCHv2 net] ipvlan: fix bound dev checking for IPv6 l3s mode

On Fri, Jun 09, 2023 at 05:15:02PM +0800, Hangbin Liu wrote:
> The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s
> mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix
> works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which
> is skb->skb_iif when there is no route.
> 
> But for IPv6, the fix is not enough, because in ipv6_raw_deliver() ->
> raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif
> instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part
> issue. Let's set IP6CB(skb)->iif to correct ifindex.
> 
> BTW, ipvlan handles NS/NA specifically. Since it works fine, I will not
> reset IP6CB(skb)->iif when addr->atype is IPVL_ICMPV6.
> 
> Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes")
> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2196710
> Signed-off-by: Hangbin Liu <liuhangbin@...il.com>

Despite broken prefix, unlike v1, this fix looks good.

Reviewed-by: Larysa Zaremba <larysa.zaremba@...el.com>

> ---
> v2: set IP6CB(skb)->iif instead of setting IP6SKB_L3SLAVE flag
> ---
>  drivers/net/ipvlan/ipvlan_l3s.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c
> index 71712ea25403..d5b05e803219 100644
> --- a/drivers/net/ipvlan/ipvlan_l3s.c
> +++ b/drivers/net/ipvlan/ipvlan_l3s.c
> @@ -102,6 +102,10 @@ static unsigned int ipvlan_nf_input(void *priv, struct sk_buff *skb,
>  
>  	skb->dev = addr->master->dev;
>  	skb->skb_iif = skb->dev->ifindex;
> +#if IS_ENABLED(CONFIG_IPV6)
> +	if (addr->atype == IPVL_IPV6)
> +		IP6CB(skb)->iif = skb->dev->ifindex;
> +#endif
>  	len = skb->len + ETH_HLEN;
>  	ipvlan_count_rx(addr->master, len, true, false);
>  out:
> -- 
> 2.38.1
> 
>