Skip to contentSkip to conversation

net/tcp: Fix socket lookups with SO_BINDTODEVICE

PATCH In review [email protected] 2 participants 2 messages Jun 18, 2018 – Jun 19, 2018

Subsystems (3)
Networking Network drivers TCP
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 net/tcp: Fix socket lookups with SO_BINDTODEVICE

From: David Ahern <[email protected]>

Similar to 69678bcd4d2d ("udp: fix SO_BINDTODEVICE"), TCP socket lookups need to fail if dev_match is not true. Currently, a packet to a given port can match a socket bound to device when it should not. In the VRF case, this causes the lookup to hit a VRF socket and not a global socket resulting in a response trying to go through the VRF when it should it.

Fixes 3fa6f616a7a4d ("net: ipv4: add second dif to inet socket lookups")
Fixes 4297a0ef08572 ("net: ipv6: add second dif to inet6 socket lookups")
Reported-by Lou Berger <[email protected]>
Diagnosed-by Renato Westphal <[email protected]>
Tested-by Renato Westphal <[email protected]>
Signed-off-by David Ahern <[email protected]>
---
 net/ipv4/inet_hashtables.c  | 4 ++--
 net/ipv6/inet6_hashtables.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/inet_hashtables.c +2 -2
index 31ff46daae97..3647167c8fa3 100644
@@ -243,9 +243,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
 			bool dev_match = (sk->sk_bound_dev_if == dif ||
 					  sk->sk_bound_dev_if == sdif);
 
-			if (exact_dif && !dev_match)
+			if (!dev_match)
 				return -1;
-			if (sk->sk_bound_dev_if && dev_match)
+			if (sk->sk_bound_dev_if)
 				score += 4;
 		}
 		if (sk->sk_incoming_cpu == raw_smp_processor_id())
net/ipv6/inet6_hashtables.c +2 -2
index 2febe26de6a1..595ad408dba0 100644
@@ -113,9 +113,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
 			bool dev_match = (sk->sk_bound_dev_if == dif ||
 					  sk->sk_bound_dev_if == sdif);
 
-			if (exact_dif && !dev_match)
+			if (!dev_match)
 				return -1;
-			if (sk->sk_bound_dev_if && dev_match)
+			if (sk->sk_bound_dev_if)
 				score++;
 		}
 		if (sk->sk_incoming_cpu == raw_smp_processor_id())
Signature · 1 line
2.11.0
maintainer
#1 lore raw

From: [email protected]
Date: Mon, 18 Jun 2018 12:30:37 -0700

Quoted 7 lines

From: David Ahern <[email protected]>

Similar to 69678bcd4d2d ("udp: fix SO_BINDTODEVICE"), TCP socket lookups need to fail if dev_match is not true. Currently, a packet to a given port can match a socket bound to device when it should not. In the VRF case, this causes the lookup to hit a VRF socket and not a global socket resulting in a response trying to go through the VRF when it should it.

                                                                      ^^^

"not", I fixed this up for you.

Quoted 6 lines
Fixes 3fa6f616a7a4d ("net: ipv4: add second dif to inet socket lookups")
Fixes 4297a0ef08572 ("net: ipv6: add second dif to inet6 socket lookups")
Reported-by Lou Berger <[email protected]>
Diagnosed-by Renato Westphal <[email protected]>
Tested-by Renato Westphal <[email protected]>
Signed-off-by David Ahern <[email protected]>

Applied and queued up for -stable, thanks.