diff mbox

net: restore ip source validation WAS(Re: [tproxy,regression] tproxy broken in 2.6.32

Message ID 1260723147.6167.20.camel@bigi
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

jamal Dec. 13, 2009, 4:52 p.m. UTC 
On Thu, 2009-12-03 at 09:29 -0500, jamal wrote:

> Dave - i can resubmit on top of Patricks changes once you swallow them.
> Or if you consider this a bug fix then i could submit before Patrick's
> (which is essentially that patch). 
> Let me know.

Ok, I am gonna pull a Rick-Jones;-> and ASS-U-ME the attached patch is
fine.

cheers,
jamal
commit 24a5f4ecb9f90be07f357b55a3c782088789a990
Author: Jamal Hadi Salim <hadi@cyberus.ca>
Date:   Sun Dec 13 11:25:52 2009 -0500

    [PATCH] net: restore ip source validation
    
    when using policy routing and the skb mark:
    there are cases where a back path validation requires us
    to use a different routing table for src ip validation than
    the one used for mapping ingress dst ip.
    One such a case is transparent proxying where we pretend to be
    the destination system and therefore the local table
    is used for incoming packets but possibly a main table would
    be used on outbound.
    Make the default behavior to allow the above and if users
    need to turn on the symmetry via sysctl src_valid_mark
    
    Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>

Comments

Julian Anastasov Dec. 13, 2009, 6:12 p.m. UTC | #1 
Hello,

On Sun, 13 Dec 2009, jamal wrote:

> Ok, I am gonna pull a Rick-Jones;-> and ASS-U-ME the attached patch is
> fine.
> 
> cheers,
> jamal

> --- a/net/ipv4/fib_frontend.c
> +++ b/net/ipv4/fib_frontend.c
> @@ -252,6 +252,8 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
>                 no_addr = in_dev->ifa_list == NULL;
>                 rpf = IN_DEV_RPFILTER(in_dev);
>                 accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
> +               if (mark && !IN_DEV_SRC_VMARK(in_dev))

	May be "fl.mark = 0;" ?:

> +                       mark = 0;
>         }
>         rcu_read_unlock();

Regards

--
Julian Anastasov <ja@ssi.bg>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
jamal Dec. 13, 2009, 6:38 p.m. UTC | #2 
On Sun, 2009-12-13 at 20:12 +0200, Julian Anastasov wrote:
> 	Hello,

> 	May be "fl.mark = 0;" ?:
> 

Of course. I will resend ..

cheers,
jamal



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
jamal Dec. 13, 2009, 7:11 p.m. UTC | #3 
On Sun, 2009-12-13 at 13:38 -0500, jamal wrote:

> Of course. I will resend ..

Updated. Much thanks Julian.

cheers,
jamal
jamal Dec. 13, 2009, 7:15 p.m. UTC | #4 
On Sun, 2009-12-13 at 14:11 -0500, jamal wrote:
> On Sun, 2009-12-13 at 13:38 -0500, jamal wrote:
> 
> > Of course. I will resend ..
> 
> Updated. Much thanks Julian.

Grrr. As a self-proclaimed master craftsman man i insist on blaming some
tool. It must be git! Proper patch attached.

cheers,
jamal
David Miller Dec. 14, 2009, 3:10 a.m. UTC | #5 
From: jamal <hadi@cyberus.ca>
Date: Sun, 13 Dec 2009 14:15:16 -0500

> On Sun, 2009-12-13 at 14:11 -0500, jamal wrote:
>> On Sun, 2009-12-13 at 13:38 -0500, jamal wrote:
>> 
>> > Of course. I will resend ..
>> 
>> Updated. Much thanks Julian.
> 
> Grrr. As a self-proclaimed master craftsman man i insist on blaming some
> tool. It must be git! Proper patch attached.

Don't use binary attachments like that please.

It doesn't end up in patchwork properly, and I need that to
happen in order to track people's work effectively.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 699e85c..b230492 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -81,6 +81,7 @@  static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_FORWARD(in_dev)		IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)		IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
 #define IN_DEV_RPFILTER(in_dev)		IN_DEV_MAXCONF((in_dev), RP_FILTER)
+#define IN_DEV_SRC_VMARK(in_dev)    	IN_DEV_ORCONF((in_dev), SRC_VMARK)
 #define IN_DEV_SOURCE_ROUTE(in_dev)	IN_DEV_ANDCONF((in_dev), \
 						       ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_ACCEPT_LOCAL(in_dev)	IN_DEV_ORCONF((in_dev), ACCEPT_LOCAL)
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 877ba03..bd27fbc 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -482,6 +482,7 @@  enum
 	NET_IPV4_CONF_ARP_ACCEPT=21,
 	NET_IPV4_CONF_ARP_NOTIFY=22,
 	NET_IPV4_CONF_ACCEPT_LOCAL=23,
+	NET_IPV4_CONF_SRC_VMARK=24,
 	__NET_IPV4_CONF_MAX
 };
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5cdbc10..040c4f0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1397,6 +1397,7 @@  static struct devinet_sysctl_table {
 		DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
 					"accept_source_route"),
 		DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
+		DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
 		DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
 		DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
 		DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 3323168..3ca6269 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -252,6 +252,8 @@  int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 		no_addr = in_dev->ifa_list == NULL;
 		rpf = IN_DEV_RPFILTER(in_dev);
 		accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
+		if (mark && !IN_DEV_SRC_VMARK(in_dev))
+			mark = 0;
 	}
 	rcu_read_unlock();