From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60564 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751038AbdALUsc (ORCPT ); Thu, 12 Jan 2017 15:48:32 -0500 Subject: Patch "net: vrf: Drop conntrack data after pass through VRF device on Tx" has been added to the 4.9-stable tree To: dsa@cumulusnetworks.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 12 Jan 2017 21:38:59 +0100 Message-ID: <1484253539166136@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled net: vrf: Drop conntrack data after pass through VRF device on Tx to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Thu Jan 12 21:37:26 CET 2017 From: David Ahern Date: Wed, 14 Dec 2016 14:31:11 -0800 Subject: net: vrf: Drop conntrack data after pass through VRF device on Tx From: David Ahern [ Upstream commit eb63ecc1706b3e094d0f57438b6c2067cfc299f2 ] Locally originated traffic in a VRF fails in the presence of a POSTROUTING rule. For example, $ iptables -t nat -A POSTROUTING -s 11.1.1.0/24 -j MASQUERADE $ ping -I red -c1 11.1.1.3 ping: Warning: source address might be selected on device other than red. PING 11.1.1.3 (11.1.1.3) from 11.1.1.2 red: 56(84) bytes of data. ping: sendmsg: Operation not permitted Worse, the above causes random corruption resulting in a panic in random places (I have not seen a consistent backtrace). Call nf_reset to drop the conntrack info following the pass through the VRF device. The nf_reset is needed on Tx but not Rx because of the order in which NF_HOOK's are hit: on Rx the VRF device is after the real ingress device and on Tx it is is before the real egress device. Connection tracking should be tied to the real egress device and not the VRF device. Fixes: 8f58336d3f78a ("net: Add ethernet header for pass through VRF device") Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device") Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/vrf.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -371,6 +371,8 @@ static int vrf_finish_output6(struct net struct in6_addr *nexthop; int ret; + nf_reset(skb); + skb->protocol = htons(ETH_P_IPV6); skb->dev = dev; @@ -552,6 +554,8 @@ static int vrf_finish_output(struct net u32 nexthop; int ret = -EINVAL; + nf_reset(skb); + /* Be paranoid, rather than too clever. */ if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) { struct sk_buff *skb2; Patches currently in stable-queue which might be from dsa@cumulusnetworks.com are queue-4.9/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch queue-4.9/net-ipv4-fix-multipath-selection-with-vrf.patch queue-4.9/net-ipv4-dst-for-local-input-routes-should-use-l3mdev-if-relevant.patch queue-4.9/net-vrf-add-missing-rx-counters.patch queue-4.9/net-vrf-do-not-allow-table-id-0.patch queue-4.9/net-vrf-fix-nat-within-a-vrf.patch queue-4.9/net-fix-incorrect-original-ingress-device-index-in-pktinfo.patch