From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Manning Subject: [PATCH net-next 4/5] ipv6: do not drop vrf udp multicast packets Date: Thu, 20 Sep 2018 09:58:47 +0100 Message-ID: <20180920085848.17721-5-mmanning@vyatta.att-mail.com> References: <20180920085848.17721-1-mmanning@vyatta.att-mail.com> Cc: Dewi Morgan To: netdev@vger.kernel.org Return-path: Received: from mx0b-00191d01.pphosted.com ([67.231.157.136]:48930 "EHLO mx0a-00191d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726177AbeITOlh (ORCPT ); Thu, 20 Sep 2018 10:41:37 -0400 Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.22/8.16.0.22) with SMTP id w8K8soqH024799 for ; Thu, 20 Sep 2018 04:59:10 -0400 Received: from tlpd255.enaf.dadc.sbc.com (sbcsmtp3.sbc.com [144.160.112.28]) by m0049459.ppops.net-00191d01. with ESMTP id 2mm279fpsg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 20 Sep 2018 04:59:10 -0400 Received: from enaf.dadc.sbc.com (localhost [127.0.0.1]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8K8x8hX006932 for ; Thu, 20 Sep 2018 03:59:09 -0500 Received: from zlp30495.vci.att.com (zlp30495.vci.att.com [135.46.181.158]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8K8x22T006722 for ; Thu, 20 Sep 2018 03:59:02 -0500 Received: from zlp30495.vci.att.com (zlp30495.vci.att.com [127.0.0.1]) by zlp30495.vci.att.com (Service) with ESMTP id 7B48240F6CEA for ; Thu, 20 Sep 2018 08:59:02 +0000 (GMT) Received: from tlpd252.dadc.sbc.com (unknown [135.31.184.157]) by zlp30495.vci.att.com (Service) with ESMTP id 5935E40F6CE5 for ; Thu, 20 Sep 2018 08:59:02 +0000 (GMT) Received: from dadc.sbc.com (localhost [127.0.0.1]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8K8x1KJ106176 for ; Thu, 20 Sep 2018 03:59:02 -0500 Received: from mail.eng.vyatta.net (mail.eng.vyatta.net [10.156.50.82]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8K8x0ZY106087 for ; Thu, 20 Sep 2018 03:59:00 -0500 In-Reply-To: <20180920085848.17721-1-mmanning@vyatta.att-mail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Dewi Morgan For bound udp sockets in a vrf, also check the sdif to get the index for ingress devices enslaved to an l3mdev. Verify the multicast address against the enslaved rather than the l3mdev device. Signed-off-by: Dewi Morgan Signed-off-by: Mike Manning --- net/ipv6/ip6_input.c | 27 ++++++++++++++++++++++++--- net/ipv6/udp.c | 8 +++++--- 2 files changed, 29 insertions(+), 6 deletions(-) diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c index 108f5f88ec98..fc60f297d95b 100644 --- a/net/ipv6/ip6_input.c +++ b/net/ipv6/ip6_input.c @@ -325,9 +325,12 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk { const struct inet6_protocol *ipprot; struct inet6_dev *idev; + struct net_device *dev; unsigned int nhoff; + int sdif = inet6_sdif(skb); int nexthdr; bool raw; + bool deliver; bool have_final = false; /* @@ -371,9 +374,27 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk skb_postpull_rcsum(skb, skb_network_header(skb), skb_network_header_len(skb)); hdr = ipv6_hdr(skb); - if (ipv6_addr_is_multicast(&hdr->daddr) && - !ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, - &hdr->saddr) && + + /* skb->dev passed may be master dev for vrfs. */ + if (sdif) { + rcu_read_lock(); + dev = dev_get_by_index_rcu(dev_net(skb->dev), + sdif); + if (!dev) { + rcu_read_unlock(); + kfree_skb(skb); + return -ENODEV; + } + } else { + dev = skb->dev; + } + + deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, + &hdr->saddr); + if (sdif) + rcu_read_unlock(); + + if (ipv6_addr_is_multicast(&hdr->daddr) && !deliver && !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb))) goto discard; } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index e22b7dd78c9b..35f71b7a1070 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -637,7 +637,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk, __be16 loc_port, const struct in6_addr *loc_addr, __be16 rmt_port, const struct in6_addr *rmt_addr, - int dif, unsigned short hnum) + int dif, int sdif, unsigned short hnum) { struct inet_sock *inet = inet_sk(sk); @@ -649,7 +649,7 @@ static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk, (inet->inet_dport && inet->inet_dport != rmt_port) || (!ipv6_addr_any(&sk->sk_v6_daddr) && !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) || - (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) || + !inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif) || (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) && !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))) return false; @@ -683,6 +683,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb, unsigned int offset = offsetof(typeof(*sk), sk_node); unsigned int hash2 = 0, hash2_any = 0, use_hash2 = (hslot->count > 10); int dif = inet6_iif(skb); + int sdif = inet6_sdif(skb); struct hlist_node *node; struct sk_buff *nskb; @@ -697,7 +698,8 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb, sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) { if (!__udp_v6_is_mcast_sock(net, sk, uh->dest, daddr, - uh->source, saddr, dif, hnum)) + uh->source, saddr, dif, sdif, + hnum)) continue; /* If zero checksum and no_check is not on for * the socket then skip it. -- 2.11.0