[PATCH] sit: Fix ipip6_tunnel_lookup device matching criteria

[PATCH] sit: Fix ipip6_tunnel_lookup device matching criteria

[Shmulik Ladkani]

As of 4fddbf5d78, when looking up a tunnel, tunnel's underlying
interface (t->parms.link) is verified to match incoming traffic's
ingress device.

However the comparison was incorrectly based on skb->dev->iflink.

Instead, dev->ifindex should be used, which correctly represents the
interface from which the IP stack hands the ipip6 packets.

This allows setting up sit tunnels bound to vlan interfaces (otherwise
incoming ipip6 traffic on the vlan interface was dropped due to
ipip6_tunnel_lookup match failure).

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
---
 net/ipv6/sit.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2e9ba035fb..6163f851dc 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -101,19 +101,19 @@ static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
 		if (local == t->parms.iph.saddr &&
 		    remote == t->parms.iph.daddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
 		if (remote == t->parms.iph.daddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
 		if (local == t->parms.iph.saddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
-- 
1.9.0

Re: [PATCH] sit: Fix ipip6_tunnel_lookup device matching criteria

[Nicolas Dichtel]

Le 14/08/2014 11:32, Shmulik Ladkani a écrit :
> As of 4fddbf5d78, when looking up a tunnel, tunnel's underlying
Please, put also the subject of the commit like this:
4fddbf5d7854 ("sit: strictly restrict incoming traffic to tunnel link device")

> interface (t->parms.link) is verified to match incoming traffic's
> ingress device.
>
> However the comparison was incorrectly based on skb->dev->iflink.
>
> Instead, dev->ifindex should be used, which correctly represents the
> interface from which the IP stack hands the ipip6 packets.
>
> This allows setting up sit tunnels bound to vlan interfaces (otherwise
> incoming ipip6 traffic on the vlan interface was dropped due to
> ipip6_tunnel_lookup match failure).
>
> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

[PATCH v2] sit: Fix ipip6_tunnel_lookup device matching criteria

[Shmulik Ladkani]

As of 4fddbf5d78 ("sit: strictly restrict incoming traffic to tunnel
link device"), when looking up a tunnel, tunnel's underlying
interface (t->parms.link) is verified to match incoming traffic's
ingress device.

However the comparison was incorrectly based on skb->dev->iflink.

Instead, dev->ifindex should be used, which correctly represents the
interface from which the IP stack hands the ipip6 packets.

This allows setting up sit tunnels bound to vlan interfaces (otherwise
incoming ipip6 traffic on the vlan interface was dropped due to
ipip6_tunnel_lookup match failure).

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
---
 net/ipv6/sit.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2e9ba035fb..6163f851dc 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -101,19 +101,19 @@ static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
 		if (local == t->parms.iph.saddr &&
 		    remote == t->parms.iph.daddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
 		if (remote == t->parms.iph.daddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
 	for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
 		if (local == t->parms.iph.saddr &&
-		    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
-- 
1.9.0

Re: [PATCH v2] sit: Fix ipip6_tunnel_lookup device matching criteria

[Nicolas Dichtel]

Le 14/08/2014 12:49, Shmulik Ladkani a écrit :
> As of 4fddbf5d78 ("sit: strictly restrict incoming traffic to tunnel
> link device"), when looking up a tunnel, tunnel's underlying
Nitpicking, but David always asks to not split subject in two lines, even
if it's more than 80 columns.

Re: [PATCH] sit: Fix ipip6_tunnel_lookup device matching criteria

[Sergei Shtylyov]

Hello.

On 8/14/2014 1:32 PM, Shmulik Ladkani wrote:

> As of 4fddbf5d78, when looking up a tunnel, tunnel's underlying

    Please also specify that commit's summary line in parens.

> interface (t->parms.link) is verified to match incoming traffic's
> ingress device.

> However the comparison was incorrectly based on skb->dev->iflink.

> Instead, dev->ifindex should be used, which correctly represents the
> interface from which the IP stack hands the ipip6 packets.

> This allows setting up sit tunnels bound to vlan interfaces (otherwise
> incoming ipip6 traffic on the vlan interface was dropped due to
> ipip6_tunnel_lookup match failure).

> Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>

WBR, Sergei