From: David Ahern <dsahern@gmail.com>
To: Antoine Tenart <atenart@kernel.org>,
davem@davemloft.net, kuba@kernel.org, dsahern@kernel.org
Cc: netdev@vger.kernel.org, Stephen Suryaputra <ssuryaextr@gmail.com>,
Paolo Abeni <pabeni@redhat.com>
Subject: Re: [PATCH net] vrf: do not push non-ND strict packets with a source LLA through packet taps again
Date: Fri, 18 Jun 2021 19:18:50 -0600 [thread overview]
Message-ID: <16920ba3-57b7-3431-4667-9aaf0d7380af@gmail.com> (raw)
In-Reply-To: <20210618151553.59456-1-atenart@kernel.org>
On 6/18/21 9:15 AM, Antoine Tenart wrote:
> Non-ND strict packets with a source LLA go through the packet taps
> again, while non-ND strict packets with other source addresses do not,
> and we can see a clone of those packets on the vrf interface (we should
> not). This is due to a series of changes:
>
> Commit 6f12fa775530[1] made non-ND strict packets not being pushed again
> in the packet taps. This changed with commit 205704c618af[2] for those
> packets having a source LLA, as they need a lookup with the orig_iif.
>
> The issue now is those packets do not skip the 'vrf_ip6_rcv' function to
> the end (as the ones without a source LLA) and go through the check to
> call packet taps again. This check was changed by commit 6f12fa775530[1]
> and do not exclude non-strict packets anymore. Packets matching
> 'need_strict && !is_ndisc && is_ll_src' are now being sent through the
> packet taps again. This can be seen by dumping packets on the vrf
> interface.
>
> Fix this by having the same code path for all non-ND strict packets and
> selectively lookup with the orig_iif for those with a source LLA. This
> has the effect to revert to the pre-205704c618af[2] condition, which
> should also be easier to maintain.
>
> [1] 6f12fa775530 ("vrf: mark skb for multicast or link-local as enslaved to VRF")
> [2] 205704c618af ("vrf: packets with lladdr src needs dst at input with orig_iif when needs strict")
>
> Fixes: 205704c618af ("vrf: packets with lladdr src needs dst at input with orig_iif when needs strict")
> Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
> Reported-by: Paolo Abeni <pabeni@redhat.com>
> Signed-off-by: Antoine Tenart <atenart@kernel.org>
> ---
> drivers/net/vrf.c | 14 +++++++-------
> 1 file changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> index 28a6c4cfe9b8..414afcb0a23f 100644
> --- a/drivers/net/vrf.c
> +++ b/drivers/net/vrf.c
> @@ -1366,22 +1366,22 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
> int orig_iif = skb->skb_iif;
> bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
> bool is_ndisc = ipv6_ndisc_frame(skb);
> - bool is_ll_src;
>
> /* loopback, multicast & non-ND link-local traffic; do not push through
> * packet taps again. Reset pkt_type for upper layers to process skb.
> - * for packets with lladdr src, however, skip so that the dst can be
> - * determine at input using original ifindex in the case that daddr
> - * needs strict
> + * For strict packets with a source LLA, determine the dst using the
> + * original ifindex.
> */
> - is_ll_src = ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL;
> - if (skb->pkt_type == PACKET_LOOPBACK ||
> - (need_strict && !is_ndisc && !is_ll_src)) {
> + if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
> skb->dev = vrf_dev;
> skb->skb_iif = vrf_dev->ifindex;
> IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
> +
> if (skb->pkt_type == PACKET_LOOPBACK)
> skb->pkt_type = PACKET_HOST;
> + else if (ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)
> + vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
> +
> goto out;
> }
>
>
you are basically moving Stephen's is_ll_src within the need_strict and
not ND.
Did you run the fcnal-test script and verify no change in test results?
next prev parent reply other threads:[~2021-06-19 1:21 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-18 15:15 [PATCH net] vrf: do not push non-ND strict packets with a source LLA through packet taps again Antoine Tenart
2021-06-19 1:18 ` David Ahern [this message]
2021-06-20 12:12 ` Antoine Tenart
2021-06-21 3:20 ` David Ahern
2021-06-21 19:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16920ba3-57b7-3431-4667-9aaf0d7380af@gmail.com \
--to=dsahern@gmail.com \
--cc=atenart@kernel.org \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=ssuryaextr@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).