netdev - [PATCH net-next 5/6] xfrm: Convert the ->dst_lookup() callback to dscp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <df58d9509a22ea12cbdfb312b57eb0eb6ea775ac.1728982714.git.gnault@redhat.com>
Date: Tue, 15 Oct 2024 11:11:42 +0200
From: Guillaume Nault <gnault@...hat.com>
To: David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>
Cc: netdev@...r.kernel.org, Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	David Ahern <dsahern@...nel.org>, Ido Schimmel <idosch@...dia.com>
Subject: [PATCH net-next 5/6] xfrm: Convert the ->dst_lookup() callback to
 dscp_t.

Pass a dscp_t variable to ->dst_lookup() callbacks (struct
xfrm_policy_afinfo), instead of an int, to prevent accidental setting
of ECN bits in ->flowi4_tos.

This callback is only called by __xfrm_dst_lookup(), which already has
a dscp_t variable to pass as parameter. We just need to remove the
inet_dscp_to_dsfield() conversion.

There are two implementations of this callback: xfrm6_dst_lookup(),
which doesn't use the modified parameter, and xfrm4_dst_lookup() which
needs to convert it again before calling __xfrm4_dst_lookup().

Signed-off-by: Guillaume Nault <gnault@...hat.com>
---
 include/net/xfrm.h      | 4 ++--
 net/ipv4/xfrm4_policy.c | 8 +++++---
 net/ipv6/xfrm6_policy.c | 5 +++--
 net/xfrm/xfrm_policy.c  | 3 +--
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 18c0a6077ae9..46c82d75679a 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -355,8 +355,8 @@ struct xfrm_type;
 struct xfrm_dst;
 struct xfrm_policy_afinfo {
 	struct dst_ops		*dst_ops;
-	struct dst_entry	*(*dst_lookup)(struct net *net,
-					       int tos, int oif,
+	struct dst_entry	*(*dst_lookup)(struct net *net, dscp_t dscp,
+					       int oif,
 					       const xfrm_address_t *saddr,
 					       const xfrm_address_t *daddr,
 					       u32 mark);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0294fef577fa..342a0158da91 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -11,6 +11,7 @@
 
 #include <linux/err.h>
 #include <linux/kernel.h>
+#include <net/inet_dscp.h>
 #include <linux/inetdevice.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
@@ -40,14 +41,15 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
 	return ERR_CAST(rt);
 }
 
-static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
+static struct dst_entry *xfrm4_dst_lookup(struct net *net, dscp_t dscp,
+					  int oif, const xfrm_address_t *saddr,
 					  const xfrm_address_t *daddr,
 					  u32 mark)
 {
 	struct flowi4 fl4;
 
-	return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark);
+	return __xfrm4_dst_lookup(net, &fl4, inet_dscp_to_dsfield(dscp), oif,
+				  saddr, daddr, mark);
 }
 
 static int xfrm4_get_saddr(struct net *net, int oif,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b1d81c4270ab..0c28b22ae3c1 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -18,13 +18,14 @@
 #include <net/addrconf.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
+#include <net/inet_dscp.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
 #include <net/l3mdev.h>
 
-static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
-					  const xfrm_address_t *saddr,
+static struct dst_entry *xfrm6_dst_lookup(struct net *net, dscp_t dscp,
+					  int oif, const xfrm_address_t *saddr,
 					  const xfrm_address_t *daddr,
 					  u32 mark)
 {
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a1b499cc840c..db2e602971fd 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -282,8 +282,7 @@ struct dst_entry *__xfrm_dst_lookup(struct net *net, dscp_t dscp, int oif,
 	if (unlikely(afinfo == NULL))
 		return ERR_PTR(-EAFNOSUPPORT);
 
-	dst = afinfo->dst_lookup(net, inet_dscp_to_dsfield(dscp), oif, saddr,
-				 daddr, mark);
+	dst = afinfo->dst_lookup(net, dscp, oif, saddr, daddr, mark);
 
 	rcu_read_unlock();
 
-- 
2.39.2