From mboxrd@z Thu Jan 1 00:00:00 1970 From: Roopa Prabhu Subject: [PATCH net] net: fib_rules: add protocol check in rule_find Date: Wed, 27 Jun 2018 18:27:16 -0700 Message-ID: <1530149236-5144-1-git-send-email-roopa@cumulusnetworks.com> Cc: netdev@vger.kernel.org To: davem@davemloft.net Return-path: Received: from mail-pl0-f66.google.com ([209.85.160.66]:40948 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751043AbeF1B1U (ORCPT ); Wed, 27 Jun 2018 21:27:20 -0400 Received: by mail-pl0-f66.google.com with SMTP id t6-v6so1897414plo.7 for ; Wed, 27 Jun 2018 18:27:20 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: From: Roopa Prabhu After commit f9d4b0c1e969 ("fib_rules: move common handling of newrule delrule msgs into fib_nl2rule"), rule_find is strict about checking for an existing rule. rule_find must check against all user given attributes, else it may match against a subset of attributes and return an existing rule. In the below case, without support for protocol match, rule_find will match only against 'table main' and return an existing rule. $ip -4 rule add table main protocol boot RTNETLINK answers: File exists This patch adds protocol support to rule_find, forcing it to check protocol match if given by the user. Fixes: f9d4b0c1e969 ("fib_rules: move common handling of newrule delrule msgs into fib_nl2rule") Signed-off-by: Roopa Prabhu --- I spent some time looking at all match keys today and protocol was the only missing one (protocol is not in a released kernel yet). The only way this could be avoided is to move back to the old loose rule_find. I am worried about this new strict checking surprising users, but going back to the previous loose checking does not seem right either. If there is a reason to believe that users did rely on the previous behaviour, I will be happy to revert. Here is another example of old and new behaviour. old rule_find behaviour: $ip -4 rule add table main protocol boot $ip -4 rule add table main protocol boot $ip -4 rule add table main protocol boot $ip rule show 0: from all lookup local 32763: from all lookup main proto boot 32764: from all lookup main proto boot 32765: from all lookup main proto boot 32766: from all lookup main 32767: from all lookup default new rule_find behaviour (after this patch): $ip -4 rule add table main protocol boot $ip -4 rule add table main protocol boot RTNETLINK answers: File exists net/core/fib_rules.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c index bc8425d..5905567 100644 --- a/net/core/fib_rules.c +++ b/net/core/fib_rules.c @@ -444,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops, if (rule->ip_proto && r->ip_proto != rule->ip_proto) continue; + if (rule->proto && r->proto != rule->proto) + continue; + if (fib_rule_port_range_set(&rule->sport_range) && !fib_rule_port_range_compare(&r->sport_range, &rule->sport_range)) -- 2.1.4