lkml.org 
[lkml]   [2021]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 69/86] netfilter: rpfilter: mask ecn bits before fib lookup
    Date
    From: Guillaume Nault <gnault@redhat.com>

    commit 2e5a6266fbb11ae93c468dfecab169aca9c27b43 upstream.

    RT_TOS() only masks one of the two ECN bits. Therefore rpfilter_mt()
    treats Not-ECT or ECT(1) packets in a different way than those with
    ECT(0) or CE.

    Reproducer:

    Create two netns, connected with a veth:
    $ ip netns add ns0
    $ ip netns add ns1
    $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
    $ ip -netns ns0 link set dev veth01 up
    $ ip -netns ns1 link set dev veth10 up
    $ ip -netns ns0 address add 192.0.2.10/32 dev veth01
    $ ip -netns ns1 address add 192.0.2.11/32 dev veth10

    Add a route to ns1 in ns0:
    $ ip -netns ns0 route add 192.0.2.11/32 dev veth01

    In ns1, only packets with TOS 4 can be routed to ns0:
    $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10

    Ping from ns0 to ns1 works regardless of the ECN bits, as long as TOS
    is 4:
    $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT
    ... 0% packet loss ...
    $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1)
    ... 0% packet loss ...
    $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0)
    ... 0% packet loss ...
    $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE
    ... 0% packet loss ...

    Now use iptable's rpfilter module in ns1:
    $ ip netns exec ns1 iptables-legacy -t raw -A PREROUTING -m rpfilter --invert -j DROP

    Not-ECT and ECT(1) packets still pass:
    $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT
    ... 0% packet loss ...
    $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1)
    ... 0% packet loss ...

    But ECT(0) and ECN packets are dropped:
    $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0)
    ... 100% packet loss ...
    $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE
    ... 100% packet loss ...

    After this patch, rpfilter doesn't drop ECT(0) and CE packets anymore.

    Fixes: 8f97339d3feb ("netfilter: add ipv4 reverse path filter match")
    Signed-off-by: Guillaume Nault <gnault@redhat.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/ipv4/netfilter/ipt_rpfilter.c
    +++ b/net/ipv4/netfilter/ipt_rpfilter.c
    @@ -76,7 +76,7 @@ static bool rpfilter_mt(const struct sk_
    flow.daddr = iph->saddr;
    flow.saddr = rpfilter_get_saddr(iph->daddr);
    flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
    - flow.flowi4_tos = RT_TOS(iph->tos);
    + flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
    flow.flowi4_scope = RT_SCOPE_UNIVERSE;
    flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));


    \
     
     \ /
      Last update: 2021-01-26 10:02    [W:3.455 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site