[PATCH] ip_forward: Drop frames with attached skb->sk

[PATCH] ip_forward: Drop frames with attached skb->sk

[Sebastian Poehn]

Initial discussion was:
[FYI] xfrm: Don't lookup sk_policy for timewait sockets

Forwarded frames should not have a socket attached. Especially
tw sockets will lead to panics later-on in the stack.

This was observed with TPROXY assigning a tw socket and broken
policy routing (misconfigured). As a result frame enters
forwarding path instead of input. We cannot solve this in
TPROXY as it cannot know that policy routing is broken.

Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
---
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 939992c..2fc3b3e 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
 	if (skb->pkt_type != PACKET_HOST)
 		goto drop;
 
+	/* this should happen neither */
+	if (unlikely(skb->sk))
+		goto drop;
+
 	if (skb_warn_if_lro(skb))
 		goto drop;
--

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[Stephen Hemminger]

On Tue, 14 Apr 2015 07:52:04 +0200
Sebastian Poehn <sebastian.poehn@gmail.com> wrote:

>  
> +	/* this should happen neither */
> +	if (unlikely(skb->sk))
> +		goto drop;
> +

With gcc, all goto's are already treated as unlikely().

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[Sebastian Poehn]

On Mon, 2015-04-13 at 23:07 -0700, Stephen Hemminger wrote:
> On Tue, 14 Apr 2015 07:52:04 +0200
> Sebastian Poehn <sebastian.poehn@gmail.com> wrote:
> 
> >  
> > +	/* this should happen neither */
> > +	if (unlikely(skb->sk))
> > +		goto drop;
> > +
> 
> With gcc, all goto's are already treated as unlikely().

Thanks for that recommendation. But before I re-cook: What about Clang
and ICC?

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[David Miller]

From: Sebastian Poehn <sebastian.poehn@gmail.com>
Date: Tue, 14 Apr 2015 08:18:40 +0200

> On Mon, 2015-04-13 at 23:07 -0700, Stephen Hemminger wrote:
>> On Tue, 14 Apr 2015 07:52:04 +0200
>> Sebastian Poehn <sebastian.poehn@gmail.com> wrote:
>> 
>> >  
>> > +	/* this should happen neither */
>> > +	if (unlikely(skb->sk))
>> > +		goto drop;
>> > +
>> 
>> With gcc, all goto's are already treated as unlikely().
> 
> Thanks for that recommendation. But before I re-cook: What about Clang
> and ICC?

I think even if this is the case with gcc, it's good documentation.

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[yzhu1]

On 04/14/2015 01:52 PM, Sebastian Poehn wrote:
> Initial discussion was:
> [FYI] xfrm: Don't lookup sk_policy for timewait sockets
>
> Forwarded frames should not have a socket attached. Especially
> tw sockets will lead to panics later-on in the stack.
>
> This was observed with TPROXY assigning a tw socket and broken
> policy routing (misconfigured). As a result frame enters
> forwarding path instead of input. We cannot solve this in
> TPROXY as it cannot know that policy routing is broken.
>
> Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
> ---
> diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
> index 939992c..2fc3b3e 100644
> --- a/net/ipv4/ip_forward.c
> +++ b/net/ipv4/ip_forward.c
> @@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
>   	if (skb->pkt_type != PACKET_HOST)
>   		goto drop;
>   
> +	/* this should happen neither */
Sorry. "neither" should be "either"?

Zhu Yanjun
> +	if (unlikely(skb->sk))
> +		goto drop;
> +
>   	if (skb_warn_if_lro(skb))
>   		goto drop;
> --
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[Sebastian Poehn]

On Tue, 2015-04-14 at 14:33 +0800, yzhu1 wrote:
> On 04/14/2015 01:52 PM, Sebastian Poehn wrote:
> > Initial discussion was:
> > [FYI] xfrm: Don't lookup sk_policy for timewait sockets
> >
> > Forwarded frames should not have a socket attached. Especially
> > tw sockets will lead to panics later-on in the stack.
> >
> > This was observed with TPROXY assigning a tw socket and broken
> > policy routing (misconfigured). As a result frame enters
> > forwarding path instead of input. We cannot solve this in
> > TPROXY as it cannot know that policy routing is broken.
> >
> > Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
> > ---
> > diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
> > index 939992c..2fc3b3e 100644
> > --- a/net/ipv4/ip_forward.c
> > +++ b/net/ipv4/ip_forward.c
> > @@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
> >   	if (skb->pkt_type != PACKET_HOST)
> >   		goto drop;
> >   
> > +	/* this should happen neither */
> Sorry. "neither" should be "either"?

        /* that should never happen */
        if (skb->pkt_type != PACKET_HOST)
                goto drop;

        /* this should happen neither */
        if (unlikely(skb->sk))
                goto drop;

Both of them should never happen.

> 
> Zhu Yanjun
> > +	if (unlikely(skb->sk))
> > +		goto drop;
> > +
> >   	if (skb_warn_if_lro(skb))
> >   		goto drop;
> > --
> >
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe netdev" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >
> 

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[Eric Dumazet]

On Tue, 2015-04-14 at 08:40 +0200, Sebastian Poehn wrote:
> On Tue, 2015-04-14 at 14:33 +0800, yzhu1 wrote:
> > On 04/14/2015 01:52 PM, Sebastian Poehn wrote:
> > > Initial discussion was:
> > > [FYI] xfrm: Don't lookup sk_policy for timewait sockets
> > >
> > > Forwarded frames should not have a socket attached. Especially
> > > tw sockets will lead to panics later-on in the stack.
> > >
> > > This was observed with TPROXY assigning a tw socket and broken
> > > policy routing (misconfigured). As a result frame enters
> > > forwarding path instead of input. We cannot solve this in
> > > TPROXY as it cannot know that policy routing is broken.
> > >
> > > Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
> > > ---
> > > diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
> > > index 939992c..2fc3b3e 100644
> > > --- a/net/ipv4/ip_forward.c
> > > +++ b/net/ipv4/ip_forward.c
> > > @@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
> > >   	if (skb->pkt_type != PACKET_HOST)
> > >   		goto drop;
> > >   
> > > +	/* this should happen neither */
> > Sorry. "neither" should be "either"?
> 
>         /* that should never happen */
>         if (skb->pkt_type != PACKET_HOST)
>                 goto drop;
> 
>         /* this should happen neither */
>         if (unlikely(skb->sk))
>                 goto drop;
> 
> Both of them should never happen.

I do not feel the comment is useful in this form.

I would prefer explicit TPROXY reference, maybe using this :

#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TPROXY)
	if (skb->sk)
		goto drop;
#endif

changelog will precisely describes the problem for the curious readers.

Thanks !

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 14 Apr 2015 04:54:47 -0700

> On Tue, 2015-04-14 at 08:40 +0200, Sebastian Poehn wrote:
>> On Tue, 2015-04-14 at 14:33 +0800, yzhu1 wrote:
>> > On 04/14/2015 01:52 PM, Sebastian Poehn wrote:
>> > > Initial discussion was:
>> > > [FYI] xfrm: Don't lookup sk_policy for timewait sockets
>> > >
>> > > Forwarded frames should not have a socket attached. Especially
>> > > tw sockets will lead to panics later-on in the stack.
>> > >
>> > > This was observed with TPROXY assigning a tw socket and broken
>> > > policy routing (misconfigured). As a result frame enters
>> > > forwarding path instead of input. We cannot solve this in
>> > > TPROXY as it cannot know that policy routing is broken.
>> > >
>> > > Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
>> > > ---
>> > > diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
>> > > index 939992c..2fc3b3e 100644
>> > > --- a/net/ipv4/ip_forward.c
>> > > +++ b/net/ipv4/ip_forward.c
>> > > @@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
>> > >   	if (skb->pkt_type != PACKET_HOST)
>> > >   		goto drop;
>> > >   
>> > > +	/* this should happen neither */
>> > Sorry. "neither" should be "either"?
>> 
>>         /* that should never happen */
>>         if (skb->pkt_type != PACKET_HOST)
>>                 goto drop;
>> 
>>         /* this should happen neither */
>>         if (unlikely(skb->sk))
>>                 goto drop;
>> 
>> Both of them should never happen.
> 
> I do not feel the comment is useful in this form.
> 
> I would prefer explicit TPROXY reference, maybe using this :
> 
> #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TPROXY)
> 	if (skb->sk)
> 		goto drop;
> #endif
> 
> changelog will precisely describes the problem for the curious readers.

I suspect we really want this test unconditionally, because we are not able
to safely operate past this point if skb->sk is NULL regardless of what made
it that way.

At least, I'll sleep more soundly at night :)

Re: [PATCH] ip_forward: Drop frames with attached skb->sk

[Sebastian Poehn]

On Tue, 2015-04-14 at 14:23 -0400, David Miller wrote:
> From: Eric Dumazet <eric.dumazet@gmail.com>
> Date: Tue, 14 Apr 2015 04:54:47 -0700
> 
> > On Tue, 2015-04-14 at 08:40 +0200, Sebastian Poehn wrote:
> >> On Tue, 2015-04-14 at 14:33 +0800, yzhu1 wrote:
> >> > On 04/14/2015 01:52 PM, Sebastian Poehn wrote:
> >> > > Initial discussion was:
> >> > > [FYI] xfrm: Don't lookup sk_policy for timewait sockets
> >> > >
> >> > > Forwarded frames should not have a socket attached. Especially
> >> > > tw sockets will lead to panics later-on in the stack.
> >> > >
> >> > > This was observed with TPROXY assigning a tw socket and broken
> >> > > policy routing (misconfigured). As a result frame enters
> >> > > forwarding path instead of input. We cannot solve this in
> >> > > TPROXY as it cannot know that policy routing is broken.
> >> > >
> >> > > Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>
> >> > > ---
> >> > > diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
> >> > > index 939992c..2fc3b3e 100644
> >> > > --- a/net/ipv4/ip_forward.c
> >> > > +++ b/net/ipv4/ip_forward.c
> >> > > @@ -82,6 +82,10 @@ int ip_forward(struct sk_buff *skb)
> >> > >   	if (skb->pkt_type != PACKET_HOST)
> >> > >   		goto drop;
> >> > >   
> >> > > +	/* this should happen neither */
> >> > Sorry. "neither" should be "either"?
> >> 
> >>         /* that should never happen */
> >>         if (skb->pkt_type != PACKET_HOST)
> >>                 goto drop;
> >> 
> >>         /* this should happen neither */
> >>         if (unlikely(skb->sk))
> >>                 goto drop;
> >> 
> >> Both of them should never happen.
> > 
> > I do not feel the comment is useful in this form.
> > 
> > I would prefer explicit TPROXY reference, maybe using this :
> > 
> > #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TPROXY)
> > 	if (skb->sk)
> > 		goto drop;
> > #endif
> > 
> > changelog will precisely describes the problem for the curious readers.
> 
> I suspect we really want this test unconditionally, because we are not able
> to safely operate past this point if skb->sk is NULL regardless of what made
> it that way.
> 
> At least, I'll sleep more soundly at night :)

I will send out a v2 patch like that when merge window has closed.
---
 		goto drop;
 
+	if (unlikely(skb->sk))
+		goto drop;
+
 	if (skb_warn_if_lro(skb))
 		goto drop;

---