From: Ido Schimmel <idosch@nvidia.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: netdev@vger.kernel.org, bpf@vger.kernel.org,
David Bauer <mail@david-bauer.net>,
Nikolay Aleksandrov <razor@blackwall.org>,
Martin KaFai Lau <martin.lau@kernel.org>
Subject: Re: [PATCH net] vxlan: Fix regression when dropping packets due to invalid src addresses
Date: Sun, 2 Jun 2024 11:37:53 +0300 [thread overview]
Message-ID: <ZlwvYesTLZVR5ezQ@shredder> (raw)
In-Reply-To: <20240531154137.26797-1-daniel@iogearbox.net>
On Fri, May 31, 2024 at 05:41:37PM +0200, Daniel Borkmann wrote:
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index f78dd0438843..7353f27b02dc 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -1605,6 +1605,7 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
> struct vxlan_sock *vs,
> struct sk_buff *skb, __be32 vni)
> {
> + bool learning = vxlan->cfg.flags & VXLAN_F_LEARN;
> union vxlan_addr saddr;
> u32 ifindex = skb->dev->ifindex;
>
> @@ -1616,8 +1617,11 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
> if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
> return false;
>
> - /* Ignore packets from invalid src-address */
> - if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
> + /* Ignore packets from invalid src-address when in learning mode,
> + * otherwise let them through e.g. when originating from NOARP
> + * devices with all-zero mac, etc.
> + */
> + if (learning && !is_valid_ether_addr(eth_hdr(skb)->h_source))
> return false;
>
> /* Get address from the outer IP header */
> @@ -1631,7 +1635,7 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
> #endif
> }
>
> - if ((vxlan->cfg.flags & VXLAN_F_LEARN) &&
> + if (learning &&
> vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source, ifindex, vni))
> return false;
Daniel, I think we can simply move this check out of the main path to
vxlan_snoop() which is only called when learning is enabled:
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 7496c14e8329..89f3945b448f 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -1446,6 +1446,10 @@ static bool vxlan_snoop(struct net_device *dev,
struct vxlan_fdb *f;
u32 ifindex = 0;
+ /* Ignore packets from invalid src-address */
+ if (!is_valid_ether_addr(src_mac))
+ return true;
+
#if IS_ENABLED(CONFIG_IPV6)
if (src_ip->sa.sa_family == AF_INET6 &&
(ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
@@ -1616,10 +1620,6 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
return false;
- /* Ignore packets from invalid src-address */
- if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
- return false;
-
/* Get address from the outer IP header */
if (vxlan_get_sk_family(vs) == AF_INET) {
saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
WDYT?
next prev parent reply other threads:[~2024-06-02 8:38 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-31 15:41 [PATCH net] vxlan: Fix regression when dropping packets due to invalid src addresses Daniel Borkmann
2024-06-02 8:37 ` Ido Schimmel [this message]
2024-06-03 7:11 ` Daniel Borkmann
2024-06-03 6:45 ` Hariprasad Kelam
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZlwvYesTLZVR5ezQ@shredder \
--to=idosch@nvidia.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=mail@david-bauer.net \
--cc=martin.lau@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=razor@blackwall.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.