Patch "udp: perform source validation for mcast early demux" has been added to the 4.13-stable tree

PATCH [email protected] 3 participants 8 messages Oct 9, 2017 – Oct 10, 2017

Subsystems (5)

Networking Network drivers Stable branch IPv4/IPv6 +1 more subsystems

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-10-09 07:35 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

udp: perform source validation for mcast early demux

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Mon Oct 9 09:32:35 CEST 2017

From: Paolo Abeni <[email protected]>
Date: Thu, 28 Sep 2017 15:51:37 +0200
Subject: udp: perform source validation for mcast early demux

From: Paolo Abeni <[email protected]>

[ Upstream commit bc044e8db7962e727a75b591b9851ff2ac5cf846 ]

The UDP early demux can leverate the rx dst cache even for multicast unconnected sockets.

In such scenario the ipv4 source address is validated only on the first packet in the given flow. After that, when we fetch the dst entry from the socket rx cache, we stop enforcing the rp_filter and we even start accepting any kind of martian addresses.

Disabling the dst cache for unconnected multicast socket will cause large performace regression, nearly reducing by half the max ingress tput.

Instead we factor out a route helper to completely validate an skb source address for multicast packets and we call it from the UDP early demux for mcast packets landing on unconnected sockets, after successful fetching the related cached dst entry.

This still gives a measurable, but limited performance regression:

		rp_filter = 0		rp_filter = 1

edmux disabled: 1182 Kpps 1127 Kpps
edmux before: 2238 Kpps 2238 Kpps
edmux after: 2037 Kpps 2019 Kpps

The above figures are on top of current net tree. Applying the net-next commit 6e617de84e87 ("net: avoid a full fib lookup when rp_filter is disabled.") the delta with rp_filter == 0 will decrease even more.

Fixes 421b3885bf6d ("udp: ipv4: Add udp early demux")

Signed-off-by Paolo Abeni <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/net/route.h |    4 +++-
 net/ipv4/route.c    |   46 ++++++++++++++++++++++++++--------------------
 net/ipv4/udp.c      |   13 ++++++++++++-
 3 files changed, 41 insertions(+), 22 deletions(-)

include/net/route.h +3 -1

@@ -175,7 +175,9 @@ static inline struct rtable *ip_route_ou
 	fl4->fl4_gre_key = gre_key;
 	return ip_route_output_key(net, fl4);
 }
-
+int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev,
+			  struct in_device *in_dev, u32 *itag);
 int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src,
 			 u8 tos, struct net_device *devin);
 int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src,

net/ipv4/route.c +26 ~~-20~~

82 lines not on this page · raw message

net/ipv4/udp.c +12 -1

@@ -2220,6 +2220,7 @@ static struct sock *__udp4_lib_demux_loo
 int udp_v4_early_demux(struct sk_buff *skb)
 {
 	struct net *net = dev_net(skb->dev);
+	struct in_device *in_dev = NULL;
 	const struct iphdr *iph;
 	const struct udphdr *uh;
 	struct sock *sk = NULL;

@@ -2236,7 +2237,7 @@ int udp_v4_early_demux(struct sk_buff *s
 
 	if (skb->pkt_type == PACKET_BROADCAST ||
 	    skb->pkt_type == PACKET_MULTICAST) {
-		struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+		in_dev = __in_dev_get_rcu(skb->dev);
 
 		if (!in_dev)
 			return 0;

@@ -2266,11 +2267,21 @@ int udp_v4_early_demux(struct sk_buff *s
 	if (dst)
 		dst = dst_check(dst, 0);
 	if (dst) {
+		u32 itag = 0;
+
 		/* set noref for now.
 		 * any place which wants to hold dst has to call
 		 * dst_hold_safe()
 		 */
 		skb_dst_set_noref(skb, dst);
+
+		/* for unconnected multicast sockets we need to validate
+		 * the source on each packet
+		 */
+		if (!inet_sk(sk)->inet_daddr && in_dev)
+			return ip_mc_validate_source(skb, iph->daddr,
+						     iph->saddr, iph->tos,
+						     skb->dev, in_dev, &itag);
 	}
 	return 0;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/udp-perform-source-validation-for-mcast-early-demux.patch queue-4.13/ipv4-early-demux-can-return-an-error-code.patch

Paolo Abeni

maintainer

2017-10-09 07:37 UTC #1 lore raw

Quoted 7 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:

This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

Quoted 6 lines

The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!

Thanks,

Paolo

Greg KH

author maintainer

2017-10-09 07:57 UTC #2 lore raw

Quoted 12 lines · Paolo Abeni

Quoted 11 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.

Quoted 5 lines

Quoted 2 lines
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!

Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?

thanks,

greg k-h

Paolo Abeni

maintainer

2017-10-09 08:02 UTC #3 lore raw

Quoted 16 lines · Greg KH

Quoted 15 lines · Paolo Abeni
Quoted 13 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 6 lines

Quoted 2 lines
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!
Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?

AFAIK the patch "IPv4: early demux can return an error code" does not have any issue - it's just useless without this one - I guess it can stay in.

Thanks,

Paolo

Greg KH

author maintainer

2017-10-09 08:54 UTC #4 lore raw

Quoted 20 lines · Paolo Abeni

Quoted 19 lines · Greg KH
Quoted 17 lines · Paolo Abeni
Quoted 7 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
Quoted 6 lines
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!

Quoted 7 lines

Quoted 3 lines
Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?
AFAIK the patch "IPv4: early demux can return an error code" does not have any issue - it's just useless without this one - I guess it can stay in.

Ok, I've now moved this one out, thanks for letting me know.

And if you happen to remember when/if a fix for this goes into the tree, that would be most helpful :)

thanks,

greg k-h

Paolo Abeni

maintainer

2017-10-10 07:16 UTC #5 lore raw

Quoted 25 lines · Greg KH

Quoted 24 lines · Paolo Abeni
Quoted 22 lines · Greg KH
Quoted 12 lines · Paolo Abeni
Quoted 11 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
Quoted 5 lines
Quoted 2 lines
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!
Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?

Quoted 8 lines

Quoted 3 lines
AFAIK the patch "IPv4: early demux can return an error code" does not have any issue - it's just useless without this one - I guess it can stay in.
Ok, I've now moved this one out, thanks for letting me know.
And if you happen to remember when/if a fix for this goes into the tree, that would be most helpful :)

Sure! the fix just entered Linus's tree: commit 996b44fcef8f ("udp: fix bcast packet reception")

Thanks,

Paolo

Greg KH

author maintainer

2017-10-10 07:31 UTC #6 lore raw

Quoted 30 lines · Paolo Abeni

Quoted 29 lines · Greg KH
Quoted 27 lines · Paolo Abeni
Quoted 16 lines · Greg KH
Quoted 15 lines · Paolo Abeni
Quoted 13 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 6 lines
Quoted 2 lines
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!
Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?
AFAIK the patch "IPv4: early demux can return an error code" does not have any issue - it's just useless without this one - I guess it can stay in.

Quoted 7 lines

Quoted 4 lines
Ok, I've now moved this one out, thanks for letting me know.
And if you happen to remember when/if a fix for this goes into the tree, that would be most helpful :)
Sure! the fix just entered Linus's tree: commit 996b44fcef8f ("udp: fix bcast packet reception")

Great! Dave, mind if I take this now, or do you want me to wait for the next round of networking patches.

thanks,

greg k-h

David Miller

maintainer

2017-10-10 17:09 UTC #7 lore raw

From: Greg KH <[email protected]>
Date: Tue, 10 Oct 2017 09:31:43 +0200

Quoted 33 lines · Paolo Abeni

Quoted 32 lines · Greg KH
Quoted 31 lines · Paolo Abeni
Quoted 20 lines · Greg KH
Quoted 19 lines · Paolo Abeni
Quoted 17 lines · On Mon, 2017-10-09 at 09:35 +0200, [email protected] wrote:
Quoted 7 lines
This is a note to let you know that I've just added the patch titled
udp: perform source validation for mcast early demux
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
Quoted 6 lines
The filename of the patch is:
udp-perform-source-validation-for-mcast-early-demux.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Please, keep this one on-hold. It needs a relevant follow-up I'm going to post soon!
Quoted 7 lines
Quoted 3 lines
Can I keep the patch before this one in the series "IPv4: early demux can return an error code"? Or should I hold off on both of these for now?
AFAIK the patch "IPv4: early demux can return an error code" does not have any issue - it's just useless without this one - I guess it can stay in.
Ok, I've now moved this one out, thanks for letting me know.

Quoted 8 lines

Quoted 5 lines
Quoted 2 lines
And if you happen to remember when/if a fix for this goes into the tree, that would be most helpful :)
Sure! the fix just entered Linus's tree: commit 996b44fcef8f ("udp: fix bcast packet reception")
Great! Dave, mind if I take this now, or do you want me to wait for the next round of networking patches.

Feel free to take this now, thanks!