[PATCH bpf] bpf: Fix fib lookup when ifindex is not set

[PATCH bpf] bpf: Fix fib lookup when ifindex is not set

[Martynas Pumputis]

Previously, bpf_ipv{4,6}_fib_lookup() with !BPF_FIB_LOOKUP_DIRECT
required a netdev identified by bpf_fib_lookup->ifindex to exist even if
the netdev's FIB table was not used for the lookup.

This commit makes the ifindex mandatory only if BPF_FIB_LOOKUP_DIRECT is
set.

Fixes: 87f5fc7e48d ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
Signed-off-by: Martynas Pumputis <m@lambda.lt>
---
 net/core/filter.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 6102f093d59a..7c8f34d9e042 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5389,14 +5389,16 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 	u32 mtu = 0;
 	int err;
 
-	dev = dev_get_by_index_rcu(net, params->ifindex);
-	if (unlikely(!dev))
-		return -ENODEV;
+	if (flags & BPF_FIB_LOOKUP_DIRECT) {
+		dev = dev_get_by_index_rcu(net, params->ifindex);
+		if (unlikely(!dev))
+			return -ENODEV;
 
-	/* verify forwarding is enabled on this interface */
-	in_dev = __in_dev_get_rcu(dev);
-	if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
-		return BPF_FIB_LKUP_RET_FWD_DISABLED;
+		/* verify forwarding is enabled on this interface */
+		in_dev = __in_dev_get_rcu(dev);
+		if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
+			return BPF_FIB_LKUP_RET_FWD_DISABLED;
+	}
 
 	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
 		fl4.flowi4_iif = 1;
@@ -5514,13 +5516,15 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 	if (rt6_need_strict(dst) || rt6_need_strict(src))
 		return BPF_FIB_LKUP_RET_NOT_FWDED;
 
-	dev = dev_get_by_index_rcu(net, params->ifindex);
-	if (unlikely(!dev))
-		return -ENODEV;
+	if (flags & BPF_FIB_LOOKUP_DIRECT) {
+		dev = dev_get_by_index_rcu(net, params->ifindex);
+		if (unlikely(!dev))
+			return -ENODEV;
 
-	idev = __in6_dev_get_safely(dev);
-	if (unlikely(!idev || !idev->cnf.forwarding))
-		return BPF_FIB_LKUP_RET_FWD_DISABLED;
+		idev = __in6_dev_get_safely(dev);
+		if (unlikely(!idev || !idev->cnf.forwarding))
+			return BPF_FIB_LKUP_RET_FWD_DISABLED;
+	}
 
 	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
 		fl6.flowi6_iif = 1;
-- 
2.34.1

Re: [PATCH bpf] bpf: Fix fib lookup when ifindex is not set

[David Ahern]

On 12/22/21 8:15 AM, Martynas Pumputis wrote:
> Previously, bpf_ipv{4,6}_fib_lookup() with !BPF_FIB_LOOKUP_DIRECT
> required a netdev identified by bpf_fib_lookup->ifindex to exist even if
> the netdev's FIB table was not used for the lookup.

there is no 'netdev FIB table'; there is only a FIB table.

The ifindex is essential information for the lookup and for verifying
forwarding is allowed on the interface.

> 
> This commit makes the ifindex mandatory only if BPF_FIB_LOOKUP_DIRECT is
> set.
> 
> Fixes: 87f5fc7e48d ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
> Signed-off-by: Martynas Pumputis <m@lambda.lt>
> ---
>  net/core/filter.c | 30 +++++++++++++++++-------------
>  1 file changed, 17 insertions(+), 13 deletions(-)
>