From: Pablo Neira Ayuso <pablo@netfilter.org>
To: David Ahern <dsa@cumulusnetworks.com>
Cc: kaber@trash.net, kadlec@blackhole.kfki.hu,
netfilter-devel@vger.kernel.org
Subject: Re: [PATCH] netfilter: Update ip_route_me_harder to consider L3 domain
Date: Mon, 14 Nov 2016 23:59:20 +0100 [thread overview]
Message-ID: <20161114225920.GA9221@salvia> (raw)
In-Reply-To: <1478715880-18952-1-git-send-email-dsa@cumulusnetworks.com>
On Wed, Nov 09, 2016 at 10:24:40AM -0800, David Ahern wrote:
> ip_route_me_harder is not considering the L3 domain and sending lookups
> to the wrong table. For example consider the following output rule:
>
> iptables -I OUTPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
>
> using perf to analyze lookups via the fib_table_lookup tracepoint shows:
>
> vrf-test 1187 [001] 46887.295927: fib:fib_table_lookup: table 255 oif 0 iif 0 src 0.0.0.0 dst 10.100.1.254 tos 0 scope 0 flags 0
> ffffffff8143922c perf_trace_fib_table_lookup ([kernel.kallsyms])
> ffffffff81493aac fib_table_lookup ([kernel.kallsyms])
> ffffffff8148dda3 __inet_dev_addr_type ([kernel.kallsyms])
> ffffffff8148ddf6 inet_addr_type ([kernel.kallsyms])
> ffffffff8149e344 ip_route_me_harder ([kernel.kallsyms])
>
> and
>
> vrf-test 1187 [001] 46887.295933: fib:fib_table_lookup: table 255 oif 0 iif 1 src 10.100.1.254 dst 10.100.1.2 tos 0 scope 0 flags
> ffffffff8143922c perf_trace_fib_table_lookup ([kernel.kallsyms])
> ffffffff81493aac fib_table_lookup ([kernel.kallsyms])
> ffffffff814998ff fib4_rule_action ([kernel.kallsyms])
> ffffffff81437f35 fib_rules_lookup ([kernel.kallsyms])
> ffffffff81499758 __fib_lookup ([kernel.kallsyms])
> ffffffff8144f010 fib_lookup.constprop.34 ([kernel.kallsyms])
> ffffffff8144f759 __ip_route_output_key_hash ([kernel.kallsyms])
> ffffffff8144fc6a ip_route_output_flow ([kernel.kallsyms])
> ffffffff8149e39b ip_route_me_harder ([kernel.kallsyms])
>
> In both cases the lookups are directed to table 255 rather than the
> table associated with the device via the L3 domain. Update both
> lookups to pull the L3 domain from the dst currently attached to the
> skb.
Does ip6_route_me_harder need an update too?
next prev parent reply other threads:[~2016-11-14 22:59 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-09 18:24 [PATCH] netfilter: Update ip_route_me_harder to consider L3 domain David Ahern
2016-11-14 22:59 ` Pablo Neira Ayuso [this message]
2016-11-14 23:04 ` David Ahern
2016-11-14 23:48 ` Pablo Neira Ayuso
2016-11-14 23:49 ` Pablo Neira Ayuso
2016-11-14 23:53 ` David Ahern
2016-11-24 11:45 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161114225920.GA9221@salvia \
--to=pablo@netfilter.org \
--cc=dsa@cumulusnetworks.com \
--cc=kaber@trash.net \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.