From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E769C282C4 for ; Wed, 13 Feb 2019 02:58:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3E1562190A for ; Wed, 13 Feb 2019 02:58:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="psJ9yr0Y" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389281AbfBMC6T (ORCPT ); Tue, 12 Feb 2019 21:58:19 -0500 Received: from mail-pg1-f193.google.com ([209.85.215.193]:34263 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389995AbfBMC6M (ORCPT ); Tue, 12 Feb 2019 21:58:12 -0500 Received: by mail-pg1-f193.google.com with SMTP id i130so452543pgd.1 for ; Tue, 12 Feb 2019 18:58:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=q3pjvwZg8W6ABQOHKLxz3Q0la33mWyvZyuP48kcn8S8=; b=psJ9yr0Y8bZCS5YGN3R4wXvT0SJMclfyGW8k1Pw+Dgf1NNtzTZocPhVefi7nXGd+tm 81IjBldUevxxFF/x1Pkoy3DXog7JsWRlySY9xLFspQgWsj9YIqRs/ZsTzweh9Td8pESq 0MbzDGXul5/f3gemsCk9e9IJ8dD4mn3bix5XoxJkZxhN5cgWG4nbVmhpf9NHmz2ejVVM gzbz6pL/M1wY+nTj8kUOAC6nZS3s6plWGayKehFvLYXzr6ar3VQlD9h3y0umx7lWKy+p h9QkMnr4poV39azy/XmZP8shHCJRmq8cQHyQ/FYcn/lujkDCbXemhVZ+t4En2wiYTU+S CppQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=q3pjvwZg8W6ABQOHKLxz3Q0la33mWyvZyuP48kcn8S8=; b=jS88FStsctkVqBXsqN2zIcTMYsLvwSx5aImFhqD3HKpRHg14oRX94GqRf9siQkZGqq rhk8C0riO7VGGXxZCBxLfbolSNr4EKndT5CbF8bJ+YxN11ETrtwfEFEgFb0NpSP16eFS MWGNQj4l9bTlNucVV3YecHsBSx+VbNYf0bIlwnw/7/FUa/2vOahZbDBD6DrlYVsMmCrX eHXupJVEfdE+ctVGrjU55QMjsM6TMmqIM5gqOB3y3hkzFo2vgnGdi02CW5m5Hi+BGBwt bPylz/5wON11QnaVkkXtc7EwX3R7mdCB7y2/4L/7LweeuKnIH1klnojk33BQdaXzApWZ Ql7A== X-Gm-Message-State: AHQUAuYs43wmjZfNaeFXdUyMSbOrhcuTR0kUi5dmSDX7GARx0J2dS18C af9TWuXHR9F17AjCtNW92tw= X-Google-Smtp-Source: AHgI3IY8LDv3icsbqcEwftRdAsA1BN3ARGiDJDzyzOa6Zz+1pZCGQq80CzbK0iE5u92PDn2MiAv6tg== X-Received: by 2002:a63:5861:: with SMTP id i33mr6761125pgm.60.1550026691900; Tue, 12 Feb 2019 18:58:11 -0800 (PST) Received: from ?IPv6:2601:282:800:fd80:9dcb:b5fc:3cc7:630f? ([2601:282:800:fd80:9dcb:b5fc:3cc7:630f]) by smtp.googlemail.com with ESMTPSA id l28sm12164928pfi.178.2019.02.12.18.58.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 12 Feb 2019 18:58:10 -0800 (PST) Subject: Re: [PATCH bpf-next v10 5/7] bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c To: Peter Oskolkov , Alexei Starovoitov , Daniel Borkmann , netdev@vger.kernel.org Cc: Peter Oskolkov , Willem de Bruijn References: <20190212173247.121342-1-posk@google.com> <20190212173247.121342-6-posk@google.com> From: David Ahern Message-ID: <681aca28-b4e5-eb0d-46cd-94db7a2c368c@gmail.com> Date: Tue, 12 Feb 2019 19:58:07 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20190212173247.121342-6-posk@google.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 2/12/19 10:32 AM, Peter Oskolkov wrote: > @@ -148,6 +174,87 @@ static int xmit_check_hhlen(struct sk_buff *skb) > return 0; > } > > +static int bpf_lwt_xmit_reroute(struct sk_buff *skb) > +{ > + struct net_device *l3mdev = l3mdev_master_dev_rcu(skb_dst(skb)->dev); > + int oif = l3mdev ? l3mdev->ifindex : 0; > + struct dst_entry *dst = NULL; > + struct sock *sk; > + struct net *net; > + bool ipv4; > + int err; > + > + if (skb->protocol == htons(ETH_P_IP)) > + ipv4 = true; > + else if (skb->protocol == htons(ETH_P_IPV6)) > + ipv4 = false; > + else > + return -EAFNOSUPPORT; > + > + sk = sk_to_full_sk(skb->sk); > + if (sk) { > + if (sk->sk_bound_dev_if) > + oif = sk->sk_bound_dev_if; > + net = sock_net(sk); > + } else { > + net = dev_net(skb_dst(skb)->dev); > + } > + > + if (ipv4) { > + struct iphdr *iph = ip_hdr(skb); > + struct flowi4 fl4 = {}; > + struct rtable *rt; > + > + fl4.flowi4_oif = oif; > + fl4.flowi4_mark = skb->mark; > + fl4.flowi4_uid = sock_net_uid(net, sk); > + fl4.flowi4_tos = RT_TOS(iph->tos); > + fl4.flowi4_flags = FLOWI_FLAG_ANYSRC; > + fl4.flowi4_proto = iph->protocol; > + fl4.daddr = iph->daddr; > + fl4.saddr = iph->saddr; > + > + rt = ip_route_output_key(net, &fl4); > + if (IS_ERR(rt) || rt->dst.error) > + return -EINVAL; I think you have a dst leak here if rt is valid but the lookup is a reject (e.g., unreachable or blackhole). > + dst = &rt->dst; > + } else { > + struct ipv6hdr *iph6 = ipv6_hdr(skb); > + struct flowi6 fl6 = {}; > + > + fl6.flowi6_oif = oif; > + fl6.flowi6_mark = skb->mark; > + fl6.flowi6_uid = sock_net_uid(net, sk); > + fl6.flowlabel = ip6_flowinfo(iph6); > + fl6.flowi6_proto = iph6->nexthdr; > + fl6.daddr = iph6->daddr; > + fl6.saddr = iph6->saddr; > + > + err = ipv6_stub->ipv6_dst_lookup(net, skb->sk, &dst, &fl6); > + if (err || IS_ERR(dst) || dst->error) > + return -EINVAL; same here. You could check this by adding a route with unreachable as the target in your tests. Test cleanup and namespace teardown will tell you pretty quick.