Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1dced6a8 authored by Sébastien Barré's avatar Sébastien Barré Committed by David S. Miller
Browse files

ipv4: Restore accept_local behaviour in fib_validate_source() 



Commit 7a9bc9b8 ("ipv4: Elide fib_validate_source() completely when possible.")
introduced a short-circuit to avoid calling fib_validate_source when not
needed. That change took rp_filter into account, but not accept_local.
This resulted in a change of behaviour: with rp_filter and accept_local
off, incoming packets with a local address in the source field should be
dropped.

Here is how to reproduce the change pre/post 7a9bc9b8 commit:
-configure the same IPv4 address on hosts A and B.
-try to send an ARP request from B to A.
-The ARP request will be dropped before that commit, but accepted and answered
after that commit.

This adds a check for ACCEPT_LOCAL, to maintain full
fib validation in case it is 0. We also leave __fib_validate_source() earlier
when possible, based on the same check as fib_validate_source(), once the
accept_local stuff is verified.

Cc: Gregory Detal <gregory.detal@uclouvain.be>
Cc: Christoph Paasch <christoph.paasch@uclouvain.be>
Cc: Hannes Frederic Sowa <hannes@redhat.com>
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: default avatarSébastien Barré <sebastien.barre@uclouvain.be>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 14462b6e

net/ipv4/fib_frontend.c

+8 −6
Original line number Diff line number Diff line
@@ -243,7 +243,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 
				 u8 tos, int oif, struct net_device *dev,

				 int rpf, struct in_device *idev, u32 *itag)

{

	int ret, no_addr, accept_local;

	int ret, no_addr;

	struct fib_result res;

	struct flowi4 fl4;

	struct net *net;
@@ -258,16 +258,17 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 


	no_addr = idev->ifa_list == NULL;



	accept_local = IN_DEV_ACCEPT_LOCAL(idev);

	fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;



	net = dev_net(dev);

	if (fib_lookup(net, &fl4, &res))

		goto last_resort;

	if (res.type != RTN_UNICAST) {

		if (res.type != RTN_LOCAL || !accept_local)

	if (res.type != RTN_UNICAST &&

	    (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))

		goto e_inval;

	}

	if (!rpf && !fib_num_tclassid_users(dev_net(dev)) &&

	    (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev)))

		goto last_resort;

	fib_combine_itag(itag, &res);

	dev_match = false;
@@ -321,6 +322,7 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, 
	int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);



	if (!r && !fib_num_tclassid_users(dev_net(dev)) &&

	    IN_DEV_ACCEPT_LOCAL(idev) &&

	    (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {

		*itag = 0;

		return 0;