* [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake
@ 2019-04-24 9:12 linmiaohe
2019-04-24 15:24 ` David Ahern
0 siblings, 1 reply; 3+ messages in thread
From: linmiaohe @ 2019-04-24 9:12 UTC (permalink / raw)
To: pablo, kadlec, fw, davem, kuznet, yoshfuji, netfilter-devel,
coreteam, netdev, linux-kernel
Cc: Mingfangsen
From: Miaohe Lin <linmiaohe@huawei.com>
When firewall is enabled with rp_filter, vrf ipv6 packets
will be dropped because in device is vrf but out device
is an enslaved device. So rt->rt6i_idev->dev != dev and
maybe return false in func rpfilter_lookup_reverse6.
Here is the out message when I ping the peer:
ip vrf exec vrf1 ping 2013::2 -c 1
1 packets transmitted, 0 received, 100% packet loss, time 0ms
The drop info in /var/log/message:
Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
SRC=2013:0000:0000:0000:0000:0000:0000:0002
DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
Signed-off-by: linmiaohe <linmiaohe@huawei.com>
---
net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index c3c6b09acdc4..cf1070ab1252 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
goto out;
}
+ if (netif_is_l3_master(dev)) {
+ dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
+ if (!dev)
+ goto out;
+ }
+
if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
ret = true;
out:
--
2.19.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake
2019-04-24 9:12 [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake linmiaohe
@ 2019-04-24 15:24 ` David Ahern
2019-04-25 7:21 ` linmiaohe
0 siblings, 1 reply; 3+ messages in thread
From: David Ahern @ 2019-04-24 15:24 UTC (permalink / raw)
To: linmiaohe, pablo, kadlec, fw, davem, kuznet, yoshfuji,
netfilter-devel, coreteam, netdev, linux-kernel
Cc: Mingfangsen
On 4/24/19 3:12 AM, linmiaohe wrote:
> From: Miaohe Lin <linmiaohe@huawei.com>
>
> When firewall is enabled with rp_filter, vrf ipv6 packets
> will be dropped because in device is vrf but out device
> is an enslaved device. So rt->rt6i_idev->dev != dev and
> maybe return false in func rpfilter_lookup_reverse6.
>
> Here is the out message when I ping the peer:
> ip vrf exec vrf1 ping 2013::2 -c 1
> 1 packets transmitted, 0 received, 100% packet loss, time 0ms
>
> The drop info in /var/log/message:
> Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
> OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
> SRC=2013:0000:0000:0000:0000:0000:0000:0002
> DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
> FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
>
> Signed-off-by: linmiaohe <linmiaohe@huawei.com>
> ---
> net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
> index c3c6b09acdc4..cf1070ab1252 100644
> --- a/net/ipv6/netfilter/ip6t_rpfilter.c
> +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
> @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
> goto out;
> }
>
> + if (netif_is_l3_master(dev)) {
> + dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
> + if (!dev)
> + goto out;
> + }
> +
> if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
> ret = true;
> out:
>
What about the case where XT_RPFILTER_LOOSE is set? flowi6_oif needs to
be set to the dev->ifindex if dev is an l3 master.
And looking at the IPv4 version I do not see how it could be correct
either. Have you tested it?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake
2019-04-24 15:24 ` David Ahern
@ 2019-04-25 7:21 ` linmiaohe
0 siblings, 0 replies; 3+ messages in thread
From: linmiaohe @ 2019-04-25 7:21 UTC (permalink / raw)
To: David Ahern, pablo, kadlec, fw, davem, kuznet, yoshfuji,
netfilter-devel, coreteam, netdev, linux-kernel
Cc: Mingfangsen
On 2019/4/24 23:24, David Ahern wrote:
> On 4/24/19 3:12 AM, linmiaohe wrote:
>> From: Miaohe Lin <linmiaohe@huawei.com>
>>
>> When firewall is enabled with rp_filter, vrf ipv6 packets
>> will be dropped because in device is vrf but out device
>> is an enslaved device. So rt->rt6i_idev->dev != dev and
>> maybe return false in func rpfilter_lookup_reverse6.
>>
>> Here is the out message when I ping the peer:
>> ip vrf exec vrf1 ping 2013::2 -c 1
>> 1 packets transmitted, 0 received, 100% packet loss, time 0ms
>>
>> The drop info in /var/log/message:
>> Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
>> OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
>> SRC=2013:0000:0000:0000:0000:0000:0000:0002
>> DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
>> FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
>>
>> Signed-off-by: linmiaohe <linmiaohe@huawei.com>
>> ---
>> net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
>> index c3c6b09acdc4..cf1070ab1252 100644
>> --- a/net/ipv6/netfilter/ip6t_rpfilter.c
>> +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
>> @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
>> goto out;
>> }
>>
>> + if (netif_is_l3_master(dev)) {
>> + dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
>> + if (!dev)
>> + goto out;
>> + }
>> +
>> if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
>> ret = true;
>> out:
>>
>
> What about the case where XT_RPFILTER_LOOSE is set? flowi6_oif needs to
> be set to the dev->ifindex if dev is an l3 master.
>
Thanks, you are right. I miss the case when XT_RPFILTER_LOOSE is set. flowi6_oif
needs to be set to the device ifindex if dev is an l3 master or l3 slave which
looks like this in function rpfilter_lookup_reverse6:
} else if ((flags & XT_RPFILTER_LOOSE) == 0) {
fl6.flowi6_oif = dev->ifindex;
} else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev))
fl6.flowi6_oif = dev->ifindex;
> And looking at the IPv4 version I do not see how it could be correct
> either. Have you tested it?
>
> .
>
I thought rp_filter is ok with ipv4 version because it works in my enviroment. But
I forgot rp_filter func in my enviroment is provided by sysctl rather than iptables
rpfilter. So I tested again and found we need to fix ipv4 version too.
Thanks for your remind, I will fix all of these and send a patch v2 soon.
Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-04-25 7:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-24 9:12 [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake linmiaohe
2019-04-24 15:24 ` David Ahern
2019-04-25 7:21 ` linmiaohe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).