breakage due to commit 6e617de84e ("net: avoid a full fib lookup when rp_filter is disabled")

breakage due to commit 6e617de84e ("net: avoid a full fib lookup when rp_filter is disabled")

[David Ahern]

[-- Attachment #1: Type: text/plain, Size: 744 bytes --]

Hi Paolo:

Your commit:

commit 6e617de84e87d626d1e976fc30e1322239fd4d2d
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Wed Sep 20 18:26:53 2017 +0200

    net: avoid a full fib lookup when rp_filter is disabled.

breaks a test case that uses a veth pair in the same network namespace
but separate VRFs. This setup:

vrf add vrf0 table 1001
vrf add vrf1 table 1002

ip link add virt01 type veth peer name virt10
ip link set virt01 master vrf0
ip link set virt10 master vrf1

ip addr add 172.16.20.20/24 dev virt01
ip link set virt01 up

ip addr add 172.16.20.21/24 dev virt10
ip link set virt10 up

ping -c 1 -I vrf0 172.16.20.21

fails due to:

    if (inet_lookup_ifaddr_rcu(net, src))
       return -EINVAL;

in fib_validate_source.

David

[-- Attachment #2: mpls-vrf-cmds --]
[-- Type: text/plain, Size: 1335 bytes --]

#!/bin/sh

# vrf0 sends out packets with mpls labels
# vrf1 receives the labelled packets, pops the labels, and forwards to vrf2
# vrf2 receives the unlabelled packets and replies to vrf0

vrf add vrf0 table 1001
vrf add vrf1 table 1002
vrf add vrf2 table 1003

ip link add virt01 type veth peer name virt10
ip link set virt01 master vrf0
ip link set virt10 master vrf1

ip link add virt12 type veth peer name virt21
ip link set virt12 master vrf1
ip link set virt21 master vrf2

ip addr add 172.16.20.20/24 dev virt01
ip link set virt01 up

ip addr add 172.16.20.21/24 dev virt10
ip link set virt10 up
ip addr add 172.16.21.21/24 dev virt12
ip link set virt12 up

ip addr add 172.16.21.22/24 dev virt21
ip link set virt21 up

modprobe mpls_iptunnel

ip route add vrf vrf0 10.10.10.10/32 encap mpls 100 via inet 172.16.20.21 
ip route add vrf vrf0 172.16.21.0/24 via 172.16.20.21 

sysctl -w net.mpls.conf.virt10.input=1
sysctl -w net.mpls.platform_labels=1000
ip -f mpls route add 100 via inet 172.16.21.22 dev virt12

ip addr add 10.10.10.10/32 dev vrf2
ip route add vrf vrf2 172.16.20.0/24 via 172.16.21.21

ping -c 1 -I vrf0 10.10.10.10

netserver

cat <<EOF
# non-mpls
netperf -J vrf0 -c -C -H 172.16.21.22 -l 10 -t TCP_STREAM

# mpls (retry this with mpls_gso loaded)
netperf -J vrf0 -c -C -H 10.10.10.10 -l 10 -t TCP_STREAM
EOF

Re: breakage due to commit 6e617de84e ("net: avoid a full fib lookup when rp_filter is disabled")

[Paolo Abeni]

On Thu, 2017-10-26 at 21:50 -0600, David Ahern wrote:
> Your commit:
> 
> commit 6e617de84e87d626d1e976fc30e1322239fd4d2d
> Author: Paolo Abeni <pabeni@redhat.com>
> Date:   Wed Sep 20 18:26:53 2017 +0200
> 
>     net: avoid a full fib lookup when rp_filter is disabled.
> 
> breaks a test case that uses a veth pair in the same network namespace
> but separate VRFs. This setup:
> 
> vrf add vrf0 table 1001
> vrf add vrf1 table 1002
> 
> ip link add virt01 type veth peer name virt10
> ip link set virt01 master vrf0
> ip link set virt10 master vrf1
> 
> ip addr add 172.16.20.20/24 dev virt01
> ip link set virt01 up
> 
> ip addr add 172.16.20.21/24 dev virt10
> ip link set virt10 up
> 
> ping -c 1 -I vrf0 172.16.20.21
> 
> fails due to:
> 
>     if (inet_lookup_ifaddr_rcu(net, src))
>        return -EINVAL;
> 
> in fib_validate_source.

Thank you for the report.

Please give me a little time to investigate the issue; unfortunately I
would not be able to work on this untill Monday.

Cheers,

Paolo