lkml.org 
[lkml]   [2019]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 35/91] netfilter: Fix rpfilter dropping vrf packets by mistake
    Date
    [ Upstream commit b575b24b8eee37f10484e951b62ce2a31c579775 ]

    When firewalld is enabled with ipv4/ipv6 rpfilter, vrf
    ipv4/ipv6 packets will be dropped. Vrf device will pass
    through netfilter hook twice. One with enslaved device
    and another one with l3 master device. So in device may
    dismatch witch out device because out device is always
    enslaved device.So failed with the check of the rpfilter
    and drop the packets by mistake.

    Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/netfilter/ipt_rpfilter.c | 1 +
    net/ipv6/netfilter/ip6t_rpfilter.c | 8 ++++++--
    2 files changed, 7 insertions(+), 2 deletions(-)

    diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
    index 12843c9ef1421..74b19a5c572e9 100644
    --- a/net/ipv4/netfilter/ipt_rpfilter.c
    +++ b/net/ipv4/netfilter/ipt_rpfilter.c
    @@ -96,6 +96,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
    flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
    flow.flowi4_tos = RT_TOS(iph->tos);
    flow.flowi4_scope = RT_SCOPE_UNIVERSE;
    + flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));

    return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
    }
    diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
    index c3c6b09acdc4f..0f3407f2851ed 100644
    --- a/net/ipv6/netfilter/ip6t_rpfilter.c
    +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
    @@ -58,7 +58,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
    if (rpfilter_addr_linklocal(&iph->saddr)) {
    lookup_flags |= RT6_LOOKUP_F_IFACE;
    fl6.flowi6_oif = dev->ifindex;
    - } else if ((flags & XT_RPFILTER_LOOSE) == 0)
    + /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */
    + } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) ||
    + (flags & XT_RPFILTER_LOOSE) == 0)
    fl6.flowi6_oif = dev->ifindex;

    rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
    @@ -73,7 +75,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
    goto out;
    }

    - if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
    + if (rt->rt6i_idev->dev == dev ||
    + l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex ||
    + (flags & XT_RPFILTER_LOOSE))
    ret = true;
    out:
    ip6_rt_put(rt);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-08-14 19:27    [W:4.158 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site