* [nf PATCH] netfilter: nft_fib: Fix for rpath check with VRF devices
@ 2022-09-20 21:24 Phil Sutter
2022-09-20 22:48 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Phil Sutter @ 2022-09-20 21:24 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Florian Westphal, Miaohe Lin, netfilter-devel
Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
dropping vrf packets by mistake") but for nftables fib expression:
Add special treatment of VRF devices so that typical reverse path
filtering via 'fib saddr . iif oif' expression works as expected.
Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
net/ipv4/netfilter/nft_fib_ipv4.c | 3 +++
net/ipv6/netfilter/nft_fib_ipv6.c | 7 ++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index b75cac69bd7e6..7ade04ff972d7 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -83,6 +83,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
else
oif = NULL;
+ if (priv->flags & NFTA_FIB_F_IIF)
+ fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
+
if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
nft_fib_store_result(dest, priv, nft_in(pkt));
diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index 8970d0b4faeb4..3f860e331580d 100644
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -170,6 +170,10 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
else if (priv->flags & NFTA_FIB_F_OIF)
oif = nft_out(pkt);
+ if ((priv->flags & NFTA_FIB_F_IIF) &&
+ (netif_is_l3_master(oif) || netif_is_l3_slave(oif)))
+ fl6.flowi6_oif = oif->ifindex;
+
iph = skb_header_pointer(pkt->skb, noff, sizeof(_iph), &_iph);
if (!iph) {
regs->verdict.code = NFT_BREAK;
@@ -197,7 +201,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
goto put_rt_err;
- if (oif && oif != rt->rt6i_idev->dev)
+ if (oif && oif != rt->rt6i_idev->dev &&
+ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
goto put_rt_err;
nft_fib_store_result(dest, priv, rt->rt6i_idev->dev);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [nf PATCH] netfilter: nft_fib: Fix for rpath check with VRF devices
2022-09-20 21:24 [nf PATCH] netfilter: nft_fib: Fix for rpath check with VRF devices Phil Sutter
@ 2022-09-20 22:48 ` Florian Westphal
2022-09-20 23:24 ` Phil Sutter
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2022-09-20 22:48 UTC (permalink / raw)
To: Phil Sutter; +Cc: Pablo Neira Ayuso, Miaohe Lin, netfilter-devel
Phil Sutter <phil@nwl.cc> wrote:
> Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
> dropping vrf packets by mistake") but for nftables fib expression:
> Add special treatment of VRF devices so that typical reverse path
> filtering via 'fib saddr . iif oif' expression works as expected.
>
> Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> net/ipv4/netfilter/nft_fib_ipv4.c | 3 +++
> net/ipv6/netfilter/nft_fib_ipv6.c | 7 ++++++-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
> index b75cac69bd7e6..7ade04ff972d7 100644
> --- a/net/ipv4/netfilter/nft_fib_ipv4.c
> +++ b/net/ipv4/netfilter/nft_fib_ipv4.c
> @@ -83,6 +83,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
> else
> oif = NULL;
>
> + if (priv->flags & NFTA_FIB_F_IIF)
> + fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
> +
> if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
> nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
> nft_fib_store_result(dest, priv, nft_in(pkt));
> diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
> index 8970d0b4faeb4..3f860e331580d 100644
> --- a/net/ipv6/netfilter/nft_fib_ipv6.c
> +++ b/net/ipv6/netfilter/nft_fib_ipv6.c
> @@ -170,6 +170,10 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
> else if (priv->flags & NFTA_FIB_F_OIF)
> oif = nft_out(pkt);
>
> + if ((priv->flags & NFTA_FIB_F_IIF) &&
> + (netif_is_l3_master(oif) || netif_is_l3_slave(oif)))
> + fl6.flowi6_oif = oif->ifindex;
> +
I was about to apply this, but this initialisation comes before
nft_fib6_flowi_init(), should this be *after*, or part of
nft_fib6_flowi_init() function instead?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [nf PATCH] netfilter: nft_fib: Fix for rpath check with VRF devices
2022-09-20 22:48 ` Florian Westphal
@ 2022-09-20 23:24 ` Phil Sutter
0 siblings, 0 replies; 3+ messages in thread
From: Phil Sutter @ 2022-09-20 23:24 UTC (permalink / raw)
To: Florian Westphal; +Cc: Pablo Neira Ayuso, Miaohe Lin, netfilter-devel
On Wed, Sep 21, 2022 at 12:48:27AM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter
> > dropping vrf packets by mistake") but for nftables fib expression:
> > Add special treatment of VRF devices so that typical reverse path
> > filtering via 'fib saddr . iif oif' expression works as expected.
> >
> > Fixes: f6d0cbcf09c50 ("netfilter: nf_tables: add fib expression")
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> > net/ipv4/netfilter/nft_fib_ipv4.c | 3 +++
> > net/ipv6/netfilter/nft_fib_ipv6.c | 7 ++++++-
> > 2 files changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
> > index b75cac69bd7e6..7ade04ff972d7 100644
> > --- a/net/ipv4/netfilter/nft_fib_ipv4.c
> > +++ b/net/ipv4/netfilter/nft_fib_ipv4.c
> > @@ -83,6 +83,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
> > else
> > oif = NULL;
> >
> > + if (priv->flags & NFTA_FIB_F_IIF)
> > + fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
> > +
> > if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
> > nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
> > nft_fib_store_result(dest, priv, nft_in(pkt));
> > diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
> > index 8970d0b4faeb4..3f860e331580d 100644
> > --- a/net/ipv6/netfilter/nft_fib_ipv6.c
> > +++ b/net/ipv6/netfilter/nft_fib_ipv6.c
> > @@ -170,6 +170,10 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
> > else if (priv->flags & NFTA_FIB_F_OIF)
> > oif = nft_out(pkt);
> >
> > + if ((priv->flags & NFTA_FIB_F_IIF) &&
> > + (netif_is_l3_master(oif) || netif_is_l3_slave(oif)))
> > + fl6.flowi6_oif = oif->ifindex;
> > +
>
> I was about to apply this, but this initialisation comes before
> nft_fib6_flowi_init(), should this be *after*, or part of
> nft_fib6_flowi_init() function instead?
Oh, I missed that one, sorry. I'll make it part of
nft_fib6_flowi_init() to better align with ip6t_rpfilter.c.
Thanks, Phil
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-09-20 23:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-09-20 21:24 [nf PATCH] netfilter: nft_fib: Fix for rpath check with VRF devices Phil Sutter
2022-09-20 22:48 ` Florian Westphal
2022-09-20 23:24 ` Phil Sutter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).