From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: netfilter-devel@vger.kernel.org, davem@davemloft.net,
netdev@vger.kernel.org
Subject: Re: [PATCH 02/14] tcp: fix mark propagation with fwmark_reflect enabled
Date: Thu, 26 Jan 2017 20:19:35 +0100 [thread overview]
Message-ID: <20170126191935.GA26591@salvia> (raw)
In-Reply-To: <1485453760.5145.144.camel@edumazet-glaptop3.roam.corp.google.com>
On Thu, Jan 26, 2017 at 10:02:40AM -0800, Eric Dumazet wrote:
> On Thu, 2017-01-26 at 17:37 +0100, Pablo Neira Ayuso wrote:
> > From: Pau Espin Pedrol <pespin.shar@gmail.com>
> >
> > Otherwise, RST packets generated by the TCP stack for non-existing
> > sockets always have mark 0.
> > The mark from the original packet is assigned to the netns_ipv4/6
> > socket used to send the response so that it can get copied into the
> > response skb when the socket sends it.
> >
> > Fixes: e110861f8609 ("net: add a sysctl to reflect the fwmark on replies")
> > Cc: Lorenzo Colitti <lorenzo@google.com>
> > Signed-off-by: Pau Espin Pedrol <pau.espin@tessares.net>
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > net/ipv4/ip_output.c | 1 +
> > net/ipv6/tcp_ipv6.c | 1 +
> > 2 files changed, 2 insertions(+)
> >
> > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> > index fac275c48108..b67719f45953 100644
> > --- a/net/ipv4/ip_output.c
> > +++ b/net/ipv4/ip_output.c
> > @@ -1629,6 +1629,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
> > sk->sk_protocol = ip_hdr(skb)->protocol;
> > sk->sk_bound_dev_if = arg->bound_dev_if;
> > sk->sk_sndbuf = sysctl_wmem_default;
> > + sk->sk_mark = fl4.flowi4_mark;
> > err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
> > len, 0, &ipc, &rt, MSG_DONTWAIT);
> > if (unlikely(err)) {
> > diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> > index 73bc8fc68acd..2b20622a5824 100644
> > --- a/net/ipv6/tcp_ipv6.c
> > +++ b/net/ipv6/tcp_ipv6.c
> > @@ -840,6 +840,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
> > dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
> > if (!IS_ERR(dst)) {
> > skb_dst_set(buff, dst);
> > + ctl_sk->sk_mark = fl6.flowi6_mark;
> > ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
> > TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
> > if (rst)
>
>
> This patch is wrong.
>
> ctl_sk is a shared socket, and tcp_v6_send_response() can be called from
> many different cpus at the same time.
Right. This is not percpu as in IPv4.
I can send a follow up patch to get this in sync with the way we do it
in IPv4, ie. add percpu socket.
Fine with this approach? Thanks!
next prev parent reply other threads:[~2017-01-26 19:19 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-26 16:37 [PATCH 00/14] Netfilter fixes for net Pablo Neira Ayuso
2017-01-26 16:37 ` [PATCH 01/14] netfilter: use fwmark_reflect in nf_send_reset Pablo Neira Ayuso
2017-01-26 16:37 ` [PATCH 02/14] tcp: fix mark propagation with fwmark_reflect enabled Pablo Neira Ayuso
2017-01-26 18:02 ` Eric Dumazet
2017-01-26 19:19 ` Pablo Neira Ayuso [this message]
2017-01-26 19:28 ` Eric Dumazet
2017-01-26 16:37 ` [PATCH 03/14] netfilter: nf_tables: fix spelling mistakes Pablo Neira Ayuso
2017-01-26 16:37 ` [PATCH 04/14] netfilter: rpfilter: fix incorrect loopback packet judgment Pablo Neira Ayuso
2017-01-26 16:37 ` [PATCH 05/14] netfilter: nf_tables: fix possible oops when dumping stateful objects Pablo Neira Ayuso
2017-01-26 16:37 ` [PATCH 06/14] netfilter: Fix typo in NF_CONNTRACK Kconfig option description Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 07/14] netfilter: ipt_CLUSTERIP: fix build error without procfs Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 08/14] netfilter: conntrack: remove GC_MAX_EVICTS break Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 09/14] netfilter: conntrack: refine gc worker heuristics, redux Pablo Neira Ayuso
2017-01-27 16:51 ` Nicolas Dichtel
2017-03-01 15:02 ` Nicolas Dichtel
2017-03-01 15:38 ` Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 10/14] netfilter: nf_tables: validate the name size when possible Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 11/14] netfilter: nft_log: restrict the log prefix length to 127 Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 12/14] netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 13/14] netfilter: nf_tables: deconstify walk callback function Pablo Neira Ayuso
2017-01-26 16:38 ` [PATCH 14/14] netfilter: nf_tables: bump set->ndeact on set flush Pablo Neira Ayuso
2017-01-26 17:59 ` [PATCH 00/14] Netfilter fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170126191935.GA26591@salvia \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).