Received: by 2002:a25:8b12:0:0:0:0:0 with SMTP id i18csp1079925ybl; Wed, 14 Aug 2019 10:22:06 -0700 (PDT) X-Google-Smtp-Source: APXvYqx5VAkvtBYJrqk7M4fxs4zbeOcdKH+oSScqnp8YSj5bDCv10x5s/SJ5FXd16BNQsCMthdvZ X-Received: by 2002:a63:5f95:: with SMTP id t143mr241477pgb.304.1565803325826; Wed, 14 Aug 2019 10:22:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1565803325; cv=none; d=google.com; s=arc-20160816; b=R2q4O9WVYNLHJMviwryMPlriGezGDMTPtO6RmZv77iFoBZrF5zXelZ7hCSZGCNXcUf iGonDSwA4Zi87JrV5wkXe3JYLfKJq1l+0UaIkra1yPqiXO1WBM5GMasELMc6K/UL1iRh GQzdtUDdRiU6tMDbq1kpGQ6WSrC1hAk7QcQlXaywyjAC/pT4j/axbNAZ6QV7GWuSP7Qq vH0pQeYmTODCaHPHuTEobGGJ85F3etG1lPz5r+FU2XnrSc4Ip9kKSbhoqySRC9sUMFhh 0inT3i3t3Tmj+qAhTBmOvjn46SeUfJ8wFrCM1Zzzw8/G1qBOAk8OBDybhPhUgX74cBBI SItQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=zwpoV7bgqxlcaduX52OJ6EcJyeku2Eb02iTm+Qk6/7o=; b=PF7q9edge5zuJTmbb5CuC7XraiBM+YL6L1wtkhbTrbrGRKWxG09ra/w7s7GwWQwmpg ziXRQDUjZ+KCYU2W3qWW3nrwBQpTcZK7965S2Gq5OyE4liFKU+k9ijTce0QuDAYFs9BQ vJYjWW3P16aowq10RvAc9w39a1rOQNXa17mhgLCNiyYQVp5ZSD4OfCimG/4pgRHD8Jkd CqdtRCPGYRvI/JUSwh5M8j5kclvujwwJkH0i2ULuXoHNr+nH279s5UWNsfgttkwB80iD wRY1+WCYXpxoaJnNjXToVKtzdeINLJdq5frfO3ncNGUXh44/jhxdzdt75/cZ84WxI8A4 IiPg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JzeLCtgI; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 34si285395plz.18.2019.08.14.10.21.50; Wed, 14 Aug 2019 10:22:05 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JzeLCtgI; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730405AbfHNRJ6 (ORCPT + 99 others); Wed, 14 Aug 2019 13:09:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:60572 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730391AbfHNRJ4 (ORCPT ); Wed, 14 Aug 2019 13:09:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D6493208C2; Wed, 14 Aug 2019 17:09:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1565802595; bh=x/eYL3iSlanQaQ7hgdilPPIYolaOzoMQ6/gvsF0Q6IY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JzeLCtgIFSvlL2IsyzB/BPO5WK0ISslRdvj/ekp7UOIvrSJHrSLFu86wDLjhahQLr a7vs5211Ck8DmF8k9jW+A0WCiOu+tqkoRf0o9nnR7q82210Mlg5f520vV0cVIm5fvP i8m4RSnCbImK5kGBZr8v5IoVAjegxmLO4mkAzTh8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.19 35/91] netfilter: Fix rpfilter dropping vrf packets by mistake Date: Wed, 14 Aug 2019 19:00:58 +0200 Message-Id: <20190814165751.182391726@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190814165748.991235624@linuxfoundation.org> References: <20190814165748.991235624@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit b575b24b8eee37f10484e951b62ce2a31c579775 ] When firewalld is enabled with ipv4/ipv6 rpfilter, vrf ipv4/ipv6 packets will be dropped. Vrf device will pass through netfilter hook twice. One with enslaved device and another one with l3 master device. So in device may dismatch witch out device because out device is always enslaved device.So failed with the check of the rpfilter and drop the packets by mistake. Signed-off-by: Miaohe Lin Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/ipv4/netfilter/ipt_rpfilter.c | 1 + net/ipv6/netfilter/ip6t_rpfilter.c | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c index 12843c9ef1421..74b19a5c572e9 100644 --- a/net/ipv4/netfilter/ipt_rpfilter.c +++ b/net/ipv4/netfilter/ipt_rpfilter.c @@ -96,6 +96,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; flow.flowi4_tos = RT_TOS(iph->tos); flow.flowi4_scope = RT_SCOPE_UNIVERSE; + flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; } diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c index c3c6b09acdc4f..0f3407f2851ed 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -58,7 +58,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, if (rpfilter_addr_linklocal(&iph->saddr)) { lookup_flags |= RT6_LOOKUP_F_IFACE; fl6.flowi6_oif = dev->ifindex; - } else if ((flags & XT_RPFILTER_LOOSE) == 0) + /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */ + } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) || + (flags & XT_RPFILTER_LOOSE) == 0) fl6.flowi6_oif = dev->ifindex; rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); @@ -73,7 +75,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, goto out; } - if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE)) + if (rt->rt6i_idev->dev == dev || + l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex || + (flags & XT_RPFILTER_LOOSE)) ret = true; out: ip6_rt_put(rt); -- 2.20.1