[PATCH net] arp: fix arp_filter on l3slave devices

[PATCH net] arp: fix arp_filter on l3slave devices

[Miguel Fadon Perlines]

arp_filter performs an ip_route_output search for arp source address and
checks if output device is the same where the arp request was received,
if it is not, the arp request is not answered.

This route lookup is always done on main route table so l3slave devices
never find the proper route and arp is not answered.

Passing l3mdev_master_ifindex_rcu(dev) return value as oif fixes the
lookup for l3slave devices while maintaining same behavior for non
l3slave devices as this function returns 0 in that case.

Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
---
 net/ipv4/arp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index f28f06c..7333db1 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 	/*unsigned long now; */
 	struct net *net = dev_net(dev);
 
-	rt = ip_route_output(net, sip, tip, 0, 0);
+	rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev));
 	if (IS_ERR(rt))
 		return 1;
 	if (rt->dst.dev != dev) {
-- 
2.1.4

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[David Ahern]

On 4/5/18 2:25 AM, Miguel Fadon Perlines wrote:
> arp_filter performs an ip_route_output search for arp source address and
> checks if output device is the same where the arp request was received,
> if it is not, the arp request is not answered.
> 
> This route lookup is always done on main route table so l3slave devices
> never find the proper route and arp is not answered.
> 
> Passing l3mdev_master_ifindex_rcu(dev) return value as oif fixes the
> lookup for l3slave devices while maintaining same behavior for non
> l3slave devices as this function returns 0 in that case.
> 
> Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
> ---
>  net/ipv4/arp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Acked-by: David Ahern <dsa@cumulusnetworks.com>

DaveM: this is a day 1 bug for VRF. Best guess at a Fixes tag would be:

Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX")

It would be good to get this into stable releases 4.9 and up. Thanks,

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[David Miller]

From: David Ahern <dsahern@gmail.com>
Date: Thu, 5 Apr 2018 08:40:48 -0600

> On 4/5/18 2:25 AM, Miguel Fadon Perlines wrote:
>> arp_filter performs an ip_route_output search for arp source address and
>> checks if output device is the same where the arp request was received,
>> if it is not, the arp request is not answered.
>> 
>> This route lookup is always done on main route table so l3slave devices
>> never find the proper route and arp is not answered.
>> 
>> Passing l3mdev_master_ifindex_rcu(dev) return value as oif fixes the
>> lookup for l3slave devices while maintaining same behavior for non
>> l3slave devices as this function returns 0 in that case.
>> 
>> Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
>> ---
>>  net/ipv4/arp.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
> 
> Acked-by: David Ahern <dsa@cumulusnetworks.com>
> 
> DaveM: this is a day 1 bug for VRF. Best guess at a Fixes tag would be:
> 
> Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX")
> 
> It would be good to get this into stable releases 4.9 and up. Thanks,

Applied and queued up for -stable.

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[Sasha Levin]

Hi,

[This is an automated email]

This commit has been processed by the -stable helper bot and determined
to be a high probability candidate for -stable trees. (score: 33.5930)

The bot has tested the following trees: v4.16, v4.15.15, v4.14.32, v4.9.92, v4.4.126.

v4.16: Build OK!
v4.15.15: Build OK!
v4.14.32: Build OK!
v4.9.92: Build OK!
v4.4.126: Build OK!

Please let us know if you'd like to have this patch included in a stable tree.

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[Sasha Levin]

Hi,

[This is an automated email]

This commit has been processed by the -stable helper bot and determined
to be a high probability candidate for -stable trees. (score: 33.5930)

The bot has tested the following trees: v4.16, v4.15.15, v4.14.32, v4.9.92, v4.4.126.

v4.16: Build OK!
v4.15.15: Build OK!
v4.14.32: Build OK!
v4.9.92: Build OK!
v4.4.126: Build OK!

Please let us know if you'd like to have this patch included in a stable tree.

--
Thanks,
Sasha

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[David Ahern]

On 4/8/18 9:36 PM, Sasha Levin wrote:
> Hi,
> 
> [This is an automated email]
> 
> This commit has been processed by the -stable helper bot and determined
> to be a high probability candidate for -stable trees. (score: 33.5930)
> 
> The bot has tested the following trees: v4.16, v4.15.15, v4.14.32, v4.9.92, v4.4.126.
> 
> v4.16: Build OK!
> v4.15.15: Build OK!
> v4.14.32: Build OK!
> v4.9.92: Build OK!
> v4.4.126: Build OK!

All of those would be good for this patch. Thanks

Re: [PATCH net] arp: fix arp_filter on l3slave devices

[David Ahern]

On 4/4/18 4:13 AM, Miguel Fadon Perlines wrote:
> arp_filter performs an ip_route_output search for arp source address and
> 
> checks if output device is the same where the arp request was received,
> 
> if it is not, the arp request is not answered.
> 
>  
> 
> This route lookup is always done on main route table so l3slave devices
> 
> never find the proper route and arp is not answered.
> 
>  
> 
> Passing l3mdev_master_ifindex_rcu(dev) return value as oif fixes the
> 
> lookup for l3slave devices while maintaining same behavior for non
> 
> l3slave devices as this function returns 0 in that case.
> 
>  
> 
> Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
> 
> ---

Miguel: The change looks fine to me. Your mail showed up as html; it
needs to be sent as plain text only.