From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Manning Subject: [PATCH net-next v1 4/5] ipv6: do not drop vrf udp multicast packets Date: Mon, 24 Sep 2018 17:13:25 +0100 Message-ID: <20180924161326.17167-5-mmanning@vyatta.att-mail.com> References: <20180924161326.17167-1-mmanning@vyatta.att-mail.com> Cc: Dewi Morgan To: netdev@vger.kernel.org Return-path: Received: from mx0a-00191d01.pphosted.com ([67.231.149.140]:53610 "EHLO mx0a-00191d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731206AbeIXWQj (ORCPT ); Mon, 24 Sep 2018 18:16:39 -0400 Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.22/8.16.0.22) with SMTP id w8OG6Lx1026491 for ; Mon, 24 Sep 2018 12:13:46 -0400 Received: from tlpd255.enaf.dadc.sbc.com (sbcsmtp3.sbc.com [144.160.112.28]) by m0049297.ppops.net-00191d01. with ESMTP id 2mq1xhkheq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 24 Sep 2018 12:13:46 -0400 Received: from enaf.dadc.sbc.com (localhost [127.0.0.1]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8OGDi46001241 for ; Mon, 24 Sep 2018 11:13:45 -0500 Received: from zlp30493.vci.att.com (zlp30493.vci.att.com [135.46.181.176]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8OGDhfn001203 for ; Mon, 24 Sep 2018 11:13:43 -0500 Received: from zlp30493.vci.att.com (zlp30493.vci.att.com [127.0.0.1]) by zlp30493.vci.att.com (Service) with ESMTP id 7A341407C7BA for ; Mon, 24 Sep 2018 16:13:43 +0000 (GMT) Received: from tlpd252.dadc.sbc.com (unknown [135.31.184.157]) by zlp30493.vci.att.com (Service) with ESMTP id 65D2F407C7B1 for ; Mon, 24 Sep 2018 16:13:43 +0000 (GMT) Received: from dadc.sbc.com (localhost [127.0.0.1]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8OGDhWP051919 for ; Mon, 24 Sep 2018 11:13:43 -0500 Received: from mail.eng.vyatta.net (mail.eng.vyatta.net [10.156.50.82]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id w8OGDcT7051515 for ; Mon, 24 Sep 2018 11:13:38 -0500 In-Reply-To: <20180924161326.17167-1-mmanning@vyatta.att-mail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Dewi Morgan For bound udp sockets in a vrf, also check the sdif to get the index for ingress devices enslaved to an l3mdev. Verify the multicast address against the enslaved rather than the l3mdev device. Signed-off-by: Dewi Morgan Signed-off-by: Mike Manning --- net/ipv6/ip6_input.c | 24 ++++++++++++++++++++---- net/ipv6/udp.c | 8 +++++--- 2 files changed, 25 insertions(+), 7 deletions(-) diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c index 108f5f88ec98..82ffb5cdd2ab 100644 --- a/net/ipv6/ip6_input.c +++ b/net/ipv6/ip6_input.c @@ -324,11 +324,14 @@ void ipv6_list_rcv(struct list_head *head, struct packet_type *pt, static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb) { const struct inet6_protocol *ipprot; + int sdif = inet6_sdif(skb); + bool have_final = false; struct inet6_dev *idev; + struct net_device *dev; unsigned int nhoff; + bool deliver; int nexthdr; bool raw; - bool have_final = false; /* * Parse extension headers @@ -371,9 +374,22 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk skb_postpull_rcsum(skb, skb_network_header(skb), skb_network_header_len(skb)); hdr = ipv6_hdr(skb); - if (ipv6_addr_is_multicast(&hdr->daddr) && - !ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, - &hdr->saddr) && + + /* skb->dev passed may be master dev for vrfs. */ + if (sdif) { + dev = dev_get_by_index_rcu(dev_net(skb->dev), + sdif); + if (!dev) { + kfree_skb(skb); + return -ENODEV; + } + } else { + dev = skb->dev; + } + + deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, + &hdr->saddr); + if (ipv6_addr_is_multicast(&hdr->daddr) && !deliver && !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb))) goto discard; } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index e22b7dd78c9b..35f71b7a1070 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -637,7 +637,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk, __be16 loc_port, const struct in6_addr *loc_addr, __be16 rmt_port, const struct in6_addr *rmt_addr, - int dif, unsigned short hnum) + int dif, int sdif, unsigned short hnum) { struct inet_sock *inet = inet_sk(sk); @@ -649,7 +649,7 @@ static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk, (inet->inet_dport && inet->inet_dport != rmt_port) || (!ipv6_addr_any(&sk->sk_v6_daddr) && !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) || - (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) || + !inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif) || (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) && !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))) return false; @@ -683,6 +683,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb, unsigned int offset = offsetof(typeof(*sk), sk_node); unsigned int hash2 = 0, hash2_any = 0, use_hash2 = (hslot->count > 10); int dif = inet6_iif(skb); + int sdif = inet6_sdif(skb); struct hlist_node *node; struct sk_buff *nskb; @@ -697,7 +698,8 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb, sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) { if (!__udp_v6_is_mcast_sock(net, sk, uh->dest, daddr, - uh->source, saddr, dif, hnum)) + uh->source, saddr, dif, sdif, + hnum)) continue; /* If zero checksum and no_check is not on for * the socket then skip it. -- 2.11.0