[PATCH net-next] sock: Reset dst when changing sk_mark via setsockopt

[PATCH net-next] sock: Reset dst when changing sk_mark via setsockopt

[David Barmann]

When setting the SO_MARK socket option, the dst needs to be reset so
that a new route lookup is performed.

This fixes the case where an application wants to change routing by
setting a new sk_mark.  If this is done after some packets have already
been sent, the dst is cached and has no effect.

Signed-off-by: David Barmann <david.barmann@stackpath.com>
---
 net/core/sock.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index 6fcc4bc07d19..187badac24a3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -950,10 +950,14 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 			clear_bit(SOCK_PASSSEC, &sock->flags);
 		break;
 	case SO_MARK:
-		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
 			ret = -EPERM;
-		else
+		} else {
+			struct dst_entry *dst = sk_dst_get(sk);
 			sk->sk_mark = val;
+			sk_dst_reset(sk);
+			dst_release(dst);
+		}
 		break;
 
 	case SO_RXQ_OVFL:
-- 
2.14.4

Re: [PATCH net-next] sock: Reset dst when changing sk_mark via setsockopt

[Eric Dumazet]

On 11/07/2018 02:33 PM, David Barmann wrote:
> When setting the SO_MARK socket option, the dst needs to be reset so
> that a new route lookup is performed.
> 
> This fixes the case where an application wants to change routing by
> setting a new sk_mark.  If this is done after some packets have already
> been sent, the dst is cached and has no effect.
> 
> Signed-off-by: David Barmann <david.barmann@stackpath.com>
> ---
>  net/core/sock.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 6fcc4bc07d19..187badac24a3 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -950,10 +950,14 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
>  			clear_bit(SOCK_PASSSEC, &sock->flags);
>  		break;
>  	case SO_MARK:
> -		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
> +		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
>  			ret = -EPERM;
> -		else
> +		} else {
> +			struct dst_entry *dst = sk_dst_get(sk);
>  			sk->sk_mark = val;
> +			sk_dst_reset(sk);


sk_dst_get() and dst_release() seems extra overhead ?

net/ipv4/ip_sockglue.c do_ip_setsockopt() has a similar handling for IP_TOS,
and it only calls sk_dst_reset() (If the new TOS is different than the current one)



So I would suggest :

	if (!ns_capable(...)) {
        	ret = -EPERM;
	} else if (val != sk->sk_mark) {
		sk->sk_mark = val;
		sk_dst_reset(sk);
	}

Re: [PATCH net-next] sock: Reset dst when changing sk_mark via setsockopt

[David Barmann]

> On 11/07/2018 02:33 PM, David Barmann wrote:

> > When setting the SO_MARK socket option, the dst needs to be reset so
> > that a new route lookup is performed.
> > 
> > This fixes the case where an application wants to change routing by
> > setting a new sk_mark.  If this is done after some packets have already
> > been sent, the dst is cached and has no effect.
> > 

> > +		} else {
> > +			struct dst_entry *dst = sk_dst_get(sk);
> >  			sk->sk_mark = val;
> > +			sk_dst_reset(sk);
> 
> 
> sk_dst_get() and dst_release() seems extra overhead ?
> 
> net/ipv4/ip_sockglue.c do_ip_setsockopt() has a similar handling for IP_TOS,
> and it only calls sk_dst_reset() (If the new TOS is different than the current one)
> 
> 
> 
> So I would suggest :
> 
> 	if (!ns_capable(...)) {
>         	ret = -EPERM;
> 	} else if (val != sk->sk_mark) {
> 		sk->sk_mark = val;
> 		sk_dst_reset(sk);
> 	}


Thanks Eric, I'll redo that and resubmit.

-David