From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: [PATCH net] netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev Date: Sun, 16 Sep 2018 21:14:42 -0700 Message-ID: <8aab23ef-094a-8a7d-d905-21a2055e9073@gmail.com> References: <20180907220813.7141-1-dsahern@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: ndsouza@ciena.com, idosch@mellanox.com To: dsahern@kernel.org, netdev@vger.kernel.org, pablo@netfilter.org, fw@strlen.de Return-path: Received: from mail-pf1-f193.google.com ([209.85.210.193]:33234 "EHLO mail-pf1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727107AbeIQJkR (ORCPT ); Mon, 17 Sep 2018 05:40:17 -0400 Received: by mail-pf1-f193.google.com with SMTP id d4-v6so6930889pfn.0 for ; Sun, 16 Sep 2018 21:14:44 -0700 (PDT) In-Reply-To: <20180907220813.7141-1-dsahern@kernel.org> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: Pablo: DaveM has this marked as waiting for upstream. Any comment on this patch? Thanks, David On 9/7/18 3:08 PM, dsahern@kernel.org wrote: > From: David Ahern > > For starters, the bridge netfilter code registers operations that > are invoked any time nh_hook is called. Specifically, ip_sabotage_in > watches for nested calls for NF_INET_PRE_ROUTING when a bridge is in > the stack. > > Packet wise, the bridge netfilter hook runs first. br_nf_pre_routing > allocates nf_bridge, sets in_prerouting to 1 and calls NF_HOOK for > NF_INET_PRE_ROUTING. It's finish function, br_nf_pre_routing_finish, > then resets in_prerouting flag to 0 and the packet continues up the > stack. The packet eventually makes it to the VRF driver and it invokes > nf_hook for NF_INET_PRE_ROUTING in case any rules have been added against > the vrf device. > > Because of the registered operations the call to nf_hook causes > ip_sabotage_in to be invoked. That function sees the nf_bridge on the > skb and that in_prerouting is not set. Thinking it is an invalid nested > call it steals (drops) the packet. > > Update ip_sabotage_in to recognize that the bridge or one of its upper > devices (e.g., vlan) can be enslaved to a VRF (L3 master device) and > allow the packet to go through the nf_hook a second time. > > Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device") > Reported-by: D'Souza, Nelson > Signed-off-by: David Ahern > --- > net/bridge/br_netfilter_hooks.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c > index 6e0dc6bcd32a..37278dc280eb 100644 > --- a/net/bridge/br_netfilter_hooks.c > +++ b/net/bridge/br_netfilter_hooks.c > @@ -835,7 +835,8 @@ static unsigned int ip_sabotage_in(void *priv, > struct sk_buff *skb, > const struct nf_hook_state *state) > { > - if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) { > + if (skb->nf_bridge && !skb->nf_bridge->in_prerouting && > + !netif_is_l3_master(skb->dev)) { > state->okfn(state->net, state->sk, skb); > return NF_STOLEN; > } >