Skip to contentSkip to conversation

net/ipv4: Initialize proto and ports in flow struct

PATCH Applied David Ahern 3 participants 3 messages May 16, 2018 – May 17, 2018

Subsystems (4)
Networking Network drivers netfilter IPv4/IPv6
lore
Share & tools
lore

David Ahern

author
#0 lore raw

PATCH v2 1/1 net/ipv4: Initialize proto and ports in flow struct

Updating the FIB tracepoint for the recent change to allow rules using the protocol and ports exposed a few places where the entries in the flow struct are not initialized.

For __fib_validate_source add the call to fib4_rules_early_flow_dissect since it is invoked for the input path. For netfilter, add the memset on the flow struct to avoid future problems like this. In ip_route_input_slow need to set the fields if the skb dissection does not happen.

Fixes bfff4862653b ("net: fib_rules: support for match on ip_proto, sport and dport")
Signed-off-by David Ahern <[email protected]>

---
Have not seen any problems with the IPv6 version

v2
- do not remove tracepoint in __fib_validate_source (sent the net-next version of this patch)
- add set of ports and proto to ip_route_input_slow if skb dissect is not done

 net/ipv4/fib_frontend.c           | 8 +++++++-
 net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
 net/ipv4/route.c                  | 7 ++++++-
 3 files changed, 14 insertions(+), 3 deletions(-)
net/ipv4/fib_frontend.c +7 -1
index f05afaf3235c..4d622112bf95 100644
@@ -326,10 +326,11 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
 				 u8 tos, int oif, struct net_device *dev,
 				 int rpf, struct in_device *idev, u32 *itag)
 {
+	struct net *net = dev_net(dev);
+	struct flow_keys flkeys;
 	int ret, no_addr;
 	struct fib_result res;
 	struct flowi4 fl4;
-	struct net *net = dev_net(dev);
 	bool dev_match;
 
 	fl4.flowi4_oif = 0;

@@ -347,6 +348,11 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
 	no_addr = idev->ifa_list == NULL;
 
 	fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
+	if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) {
+		fl4.flowi4_proto = 0;
+		fl4.fl4_sport = 0;
+		fl4.fl4_dport = 0;
+	}
 
 	trace_fib_validate_source(dev, &fl4);
net/ipv4/netfilter/ipt_rpfilter.c +1 -1
index fd01f13c896a..12843c9ef142 100644
@@ -89,10 +89,10 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 			return true ^ invert;
 	}
 
+	memset(&flow, 0, sizeof(flow));
 	flow.flowi4_iif = LOOPBACK_IFINDEX;
 	flow.daddr = iph->saddr;
 	flow.saddr = rpfilter_get_saddr(iph->daddr);
-	flow.flowi4_oif = 0;
 	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
 	flow.flowi4_tos = RT_TOS(iph->tos);
 	flow.flowi4_scope = RT_SCOPE_UNIVERSE;
net/ipv4/route.c +6 -1
index 29268efad247..2cfa1b518f8d 100644
@@ -1961,8 +1961,13 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 	fl4.saddr = saddr;
 	fl4.flowi4_uid = sock_net_uid(net, NULL);
 
-	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys))
+	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
 		flkeys = &_flkeys;
+	} else {
+		fl4.flowi4_proto = 0;
+		fl4.fl4_sport = 0;
+		fl4.fl4_dport = 0;
+	}
 
 	err = fib_lookup(net, &fl4, res, 0);
 	if (err != 0) {
Signature · 1 line
2.11.0
Acked-by on v2 1/1
#1 lore raw
Quoted 4 lines · David Ahern

Updating the FIB tracepoint for the recent change to allow rules using the protocol and ports exposed a few places where the entries in the flow struct are not initialized.

Quoted 8 lines

For __fib_validate_source add the call to fib4_rules_early_flow_dissect since it is invoked for the input path. For netfilter, add the memset on the flow struct to avoid future problems like this. In ip_route_input_slow need to set the fields if the skb dissection does not happen.

Fixes bfff4862653b ("net: fib_rules: support for match on ip_proto, sport and dport")
Signed-off-by David Ahern <[email protected]>

---

LGTM,

Acked-by Roopa Prabhu <[email protected]>
maintainer Applied
#2 lore raw
In reply to David Ahern

From: David Ahern <[email protected]>
Date: Wed, 16 May 2018 13:36:40 -0700

Quoted 11 lines

Updating the FIB tracepoint for the recent change to allow rules using the protocol and ports exposed a few places where the entries in the flow struct are not initialized.

For __fib_validate_source add the call to fib4_rules_early_flow_dissect since it is invoked for the input path. For netfilter, add the memset on the flow struct to avoid future problems like this. In ip_route_input_slow need to set the fields if the skb dissection does not happen.

Fixes bfff4862653b ("net: fib_rules: support for match on ip_proto, sport and dport")
Signed-off-by David Ahern <[email protected]>
Quoted 8 lines

---
Have not seen any problems with the IPv6 version

v2
- do not remove tracepoint in __fib_validate_source (sent the net-next version of this patch)
- add set of ports and proto to ip_route_input_slow if skb dissect is not done

Applied, thanks David.