Message ID | 094b7376-f796-71b6-7a81-28866b0f882b@huawei.com |
---|---|
State | Awaiting Upstream |
Delegated to: | David Miller |
Headers | show |
Series | net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake | expand |
linmiaohe <linmiaohe@huawei.com> wrote: [ CC dsa, dropped some CCs ] > When firewall is enabled with rp_filter, vrf ipv6 packets > will be dropped because in device is vrf but out device > is an enslaved device. So rt->rt6i_idev->dev != dev and > maybe return false in func rpfilter_lookup_reverse6. > > Here is the out message when I ping the peer: > ip vrf exec vrf1 ping 2013::2 -c 1 > 1 packets transmitted, 0 received, 100% packet loss, time 0ms > > The drop info in /var/log/message: > Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1 > OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd > SRC=2013:0000:0000:0000:0000:0000:0000:0002 > DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64 > FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1 > > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > --- > net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c > index c3c6b09acdc4..5cbc91f53736 100644 > --- a/net/ipv6/netfilter/ip6t_rpfilter.c > +++ b/net/ipv6/netfilter/ip6t_rpfilter.c > @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, > goto out; > } > > + if (netif_is_l3_master(dev)) { > + dev = __dev_get_by_index(dev_net(dev), IP6CB(skb)->iif); > + if (!dev) > + goto out; I suspect this should be 'dev_get_by_index_rcu'.
On 2019/4/24 16:02, Florian Westphal wrote: > linmiaohe <linmiaohe@huawei.com> wrote: > > [ CC dsa, dropped some CCs ] > >> When firewall is enabled with rp_filter, vrf ipv6 packets >> will be dropped because in device is vrf but out device >> is an enslaved device. So rt->rt6i_idev->dev != dev and >> maybe return false in func rpfilter_lookup_reverse6. >> >> Here is the out message when I ping the peer: >> ip vrf exec vrf1 ping 2013::2 -c 1 >> 1 packets transmitted, 0 received, 100% packet loss, time 0ms >> >> The drop info in /var/log/message: >> Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1 >> OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd >> SRC=2013:0000:0000:0000:0000:0000:0000:0002 >> DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64 >> FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1 >> >> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> >> --- >> net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c >> index c3c6b09acdc4..5cbc91f53736 100644 >> --- a/net/ipv6/netfilter/ip6t_rpfilter.c >> +++ b/net/ipv6/netfilter/ip6t_rpfilter.c >> @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, >> goto out; >> } >> >> + if (netif_is_l3_master(dev)) { >> + dev = __dev_get_by_index(dev_net(dev), IP6CB(skb)->iif); >> + if (!dev) >> + goto out; > > I suspect this should be 'dev_get_by_index_rcu'. > > . > You are right, it's my mistake.Thanks for your remind.I will send v2 to fix this. Thanks.
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c index c3c6b09acdc4..5cbc91f53736 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, goto out; } + if (netif_is_l3_master(dev)) { + dev = __dev_get_by_index(dev_net(dev), IP6CB(skb)->iif); + if (!dev) + goto out; + } + if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE)) ret = true; out: