From: Arnd Bergmann <arnd@arndb.de> To: David Miller <davem@davemloft.net> Cc: Stephen Hemminger <shemminger@linux-foundation.org>, Patrick McHardy <kaber@trash.net>, "Michael S. Tsirkin" <mst@redhat.com>, Herbert Xu <herbert@gondor.apana.org.au>, Or Gerlitz <ogerlitz@voltaire.com>, netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/3] net: maintain namespace isolation between vlan and real device Date: Wed, 27 Jan 2010 11:05:15 +0100 [thread overview] Message-ID: <201001271105.15733.arnd@arndb.de> (raw) In-Reply-To: <201001271104.20607.arnd@arndb.de> In the vlan and macvlan drivers, the start_xmit function forwards data to the dev_queue_xmit function for another device, which may potentially belong to a different namespace. To make sure that classification stays within a single namespace, this resets the potentially critical fields. Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- drivers/net/macvlan.c | 2 +- include/linux/netdevice.h | 9 +++++++++ net/8021q/vlan_dev.c | 2 +- net/core/dev.c | 35 +++++++++++++++++++++++++++++++---- 4 files changed, 42 insertions(+), 6 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index bad1303..e0436fd 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -269,7 +269,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev) } xmit_world: - skb->dev = vlan->lowerdev; + skb_set_dev(skb, vlan->lowerdev); return dev_queue_xmit(skb); } diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 93a32a5..622ba5a 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1004,6 +1004,15 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev) return 0; } +#ifndef CONFIG_NET_NS +static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev) +{ + skb->dev = dev; +} +#else /* CONFIG_NET_NS */ +void skb_set_dev(struct sk_buff *skb, struct net_device *dev); +#endif + static inline bool netdev_uses_trailer_tags(struct net_device *dev) { #ifdef CONFIG_NET_DSA_TAG_TRAILER diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c index 77a49ff..95034a8 100644 --- a/net/8021q/vlan_dev.c +++ b/net/8021q/vlan_dev.c @@ -322,7 +322,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb, } - skb->dev = vlan_dev_info(dev)->real_dev; + skb_set_dev(skb, vlan_dev_info(dev)->real_dev); len = skb->len; ret = dev_queue_xmit(skb); diff --git a/net/core/dev.c b/net/core/dev.c index 2cba5c5..e80403a 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1448,13 +1448,10 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) if (skb->len > (dev->mtu + dev->hard_header_len)) return NET_RX_DROP; - skb_dst_drop(skb); + skb_set_dev(skb, dev); skb->tstamp.tv64 = 0; skb->pkt_type = PACKET_HOST; skb->protocol = eth_type_trans(skb, dev); - skb->mark = 0; - secpath_reset(skb); - nf_reset(skb); return netif_rx(skb); } EXPORT_SYMBOL_GPL(dev_forward_skb); @@ -1614,6 +1611,36 @@ static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb) return false; } +/** + * skb_dev_set -- assign a buffer to a new device + * @skb: buffer for the new device + * @dev: network device + * + * If an skb is owned by a device already, we have to reset + * all data private to the namespace a device belongs to + * before assigning it a new device. + */ +#ifdef CONFIG_NET_NS +void skb_set_dev(struct sk_buff *skb, struct net_device *dev) +{ + skb_dst_drop(skb); + if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) { + secpath_reset(skb); + nf_reset(skb); + skb_init_secmark(skb); + skb->mark = 0; + skb->priority = 0; + skb->nf_trace = 0; + skb->ipvs_property = 0; +#ifdef CONFIG_NET_SCHED + skb->tc_index = 0; +#endif + } + skb->dev = dev; +} +EXPORT_SYMBOL(skb_set_dev); +#endif /* CONFIG_NET_NS */ + /* * Invalidate hardware checksum when packet is to be mangled, and * complete checksum manually on outgoing path. -- 1.6.3.3
WARNING: multiple messages have this Message-ID (diff)
From: Arnd Bergmann <arnd@arndb.de> To: David Miller <davem@davemloft.net> Cc: Herbert Xu <herbert@gondor.apana.org.au>, "Michael S. Tsirkin" <mst@redhat.com>, netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Or Gerlitz <ogerlitz@voltaire.com> Subject: [Bridge] [PATCH 1/3] net: maintain namespace isolation between vlan and real device Date: Wed, 27 Jan 2010 11:05:15 +0100 [thread overview] Message-ID: <201001271105.15733.arnd@arndb.de> (raw) In-Reply-To: <201001271104.20607.arnd@arndb.de> In the vlan and macvlan drivers, the start_xmit function forwards data to the dev_queue_xmit function for another device, which may potentially belong to a different namespace. To make sure that classification stays within a single namespace, this resets the potentially critical fields. Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- drivers/net/macvlan.c | 2 +- include/linux/netdevice.h | 9 +++++++++ net/8021q/vlan_dev.c | 2 +- net/core/dev.c | 35 +++++++++++++++++++++++++++++++---- 4 files changed, 42 insertions(+), 6 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index bad1303..e0436fd 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -269,7 +269,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev) } xmit_world: - skb->dev = vlan->lowerdev; + skb_set_dev(skb, vlan->lowerdev); return dev_queue_xmit(skb); } diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 93a32a5..622ba5a 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1004,6 +1004,15 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev) return 0; } +#ifndef CONFIG_NET_NS +static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev) +{ + skb->dev = dev; +} +#else /* CONFIG_NET_NS */ +void skb_set_dev(struct sk_buff *skb, struct net_device *dev); +#endif + static inline bool netdev_uses_trailer_tags(struct net_device *dev) { #ifdef CONFIG_NET_DSA_TAG_TRAILER diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c index 77a49ff..95034a8 100644 --- a/net/8021q/vlan_dev.c +++ b/net/8021q/vlan_dev.c @@ -322,7 +322,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb, } - skb->dev = vlan_dev_info(dev)->real_dev; + skb_set_dev(skb, vlan_dev_info(dev)->real_dev); len = skb->len; ret = dev_queue_xmit(skb); diff --git a/net/core/dev.c b/net/core/dev.c index 2cba5c5..e80403a 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1448,13 +1448,10 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) if (skb->len > (dev->mtu + dev->hard_header_len)) return NET_RX_DROP; - skb_dst_drop(skb); + skb_set_dev(skb, dev); skb->tstamp.tv64 = 0; skb->pkt_type = PACKET_HOST; skb->protocol = eth_type_trans(skb, dev); - skb->mark = 0; - secpath_reset(skb); - nf_reset(skb); return netif_rx(skb); } EXPORT_SYMBOL_GPL(dev_forward_skb); @@ -1614,6 +1611,36 @@ static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb) return false; } +/** + * skb_dev_set -- assign a buffer to a new device + * @skb: buffer for the new device + * @dev: network device + * + * If an skb is owned by a device already, we have to reset + * all data private to the namespace a device belongs to + * before assigning it a new device. + */ +#ifdef CONFIG_NET_NS +void skb_set_dev(struct sk_buff *skb, struct net_device *dev) +{ + skb_dst_drop(skb); + if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) { + secpath_reset(skb); + nf_reset(skb); + skb_init_secmark(skb); + skb->mark = 0; + skb->priority = 0; + skb->nf_trace = 0; + skb->ipvs_property = 0; +#ifdef CONFIG_NET_SCHED + skb->tc_index = 0; +#endif + } + skb->dev = dev; +} +EXPORT_SYMBOL(skb_set_dev); +#endif /* CONFIG_NET_NS */ + /* * Invalidate hardware checksum when packet is to be mangled, and * complete checksum manually on outgoing path. -- 1.6.3.3
next prev parent reply other threads:[~2010-01-27 21:11 UTC|newest] Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top 2010-01-27 10:04 [PATCH 0/3 v3] macvtap driver Arnd Bergmann 2010-01-27 10:04 ` [Bridge] " Arnd Bergmann 2010-01-27 10:05 ` Arnd Bergmann [this message] 2010-01-27 10:05 ` [Bridge] [PATCH 1/3] net: maintain namespace isolation between vlan and real device Arnd Bergmann 2010-01-29 5:33 ` David Miller 2010-01-29 5:33 ` [Bridge] " David Miller 2010-01-29 10:12 ` Arnd Bergmann 2010-01-29 10:12 ` [Bridge] " Arnd Bergmann 2010-01-27 10:06 ` [PATCH 2/3] net/macvlan: allow multiple driver backends Arnd Bergmann 2010-01-27 10:06 ` [Bridge] " Arnd Bergmann 2010-01-27 21:09 ` [PATCH 3/3] net: macvtap driver Arnd Bergmann 2010-01-27 21:09 ` [Bridge] " Arnd Bergmann 2010-01-28 17:34 ` Michael S. Tsirkin 2010-01-28 17:34 ` [Bridge] " Michael S. Tsirkin 2010-01-28 20:18 ` Arnd Bergmann 2010-01-28 20:18 ` [Bridge] " Arnd Bergmann 2010-01-29 11:21 ` Michael S. Tsirkin 2010-01-29 11:21 ` [Bridge] " Michael S. Tsirkin 2010-01-29 19:49 ` Arnd Bergmann 2010-01-29 19:49 ` [Bridge] " Arnd Bergmann 2010-01-27 21:59 ` [PATCH 0/3 v3] " Arnd Bergmann 2010-01-27 21:59 ` [Bridge] " Arnd Bergmann 2010-01-30 22:22 ` [PATCH 0/3 v4] " Arnd Bergmann 2010-01-30 22:22 ` Arnd Bergmann 2010-01-30 22:22 ` [Bridge] " Arnd Bergmann 2010-01-30 22:23 ` [PATCH 1/3] net: maintain namespace isolation between vlan and real device Arnd Bergmann 2010-01-30 22:23 ` Arnd Bergmann 2010-01-30 22:23 ` [Bridge] " Arnd Bergmann 2010-01-30 22:23 ` [PATCH 2/3] macvlan: allow multiple driver backends Arnd Bergmann 2010-01-30 22:23 ` Arnd Bergmann 2010-01-30 22:23 ` [Bridge] " Arnd Bergmann 2010-01-30 22:24 ` [PATCH 3/3] net: macvtap driver Arnd Bergmann 2010-01-30 22:24 ` Arnd Bergmann 2010-01-30 22:24 ` [Bridge] " Arnd Bergmann 2010-02-04 4:21 ` [PATCH 0/3 v4] " David Miller 2010-02-04 4:21 ` David Miller 2010-02-04 4:21 ` [Bridge] " David Miller 2010-02-08 17:14 ` Ed Swierk 2010-02-08 18:55 ` Sridhar Samudrala 2010-02-08 23:30 ` Ed Swierk 2010-02-10 14:50 ` Arnd Bergmann 2010-02-11 0:42 ` Ed Swierk 2010-02-11 7:12 ` Arnd Bergmann 2010-02-09 3:25 ` Ed Swierk 2010-02-10 14:52 ` Arnd Bergmann 2010-02-10 14:48 ` Arnd Bergmann 2010-02-10 18:05 ` Sridhar Samudrala 2010-02-10 18:10 ` Patrick McHardy 2010-02-11 15:45 ` [PATCH] net/macvtap: fix reference counting Arnd Bergmann 2010-02-11 15:55 ` [PATCH v2] " Arnd Bergmann 2010-02-11 21:09 ` Sridhar Samudrala 2010-02-16 5:53 ` David Miller 2010-02-18 15:44 ` Arnd Bergmann 2010-02-18 15:45 ` [PATCH 1/3] macvtap: rework object lifetime rules Arnd Bergmann 2010-02-18 20:09 ` Sridhar Samudrala 2010-02-18 22:11 ` David Miller 2010-02-18 15:46 ` [PATCH 2/3] net/macvtap: add vhost support Arnd Bergmann 2010-02-18 20:10 ` Sridhar Samudrala 2010-02-18 22:11 ` David Miller 2010-02-18 15:48 ` [PATCH 3/3] macvtap: add GSO/csum offload support Arnd Bergmann 2010-02-18 20:38 ` Sridhar Samudrala 2010-02-18 22:11 ` David Miller 2010-02-12 20:58 ` [PATCH v2] net/macvtap: fix reference counting Ed Swierk
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=201001271105.15733.arnd@arndb.de \ --to=arnd@arndb.de \ --cc=bridge@lists.linux-foundation.org \ --cc=davem@davemloft.net \ --cc=herbert@gondor.apana.org.au \ --cc=kaber@trash.net \ --cc=linux-kernel@vger.kernel.org \ --cc=mst@redhat.com \ --cc=netdev@vger.kernel.org \ --cc=ogerlitz@voltaire.com \ --cc=shemminger@linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.