diff mbox

[stable] ipv6: restrict neighbor entry creation to output flow

Message ID abab9dc5af4b61da70672b99ad80175b94b4ec68.1376488215.git.mleitner@redhat.com
State Not Applicable, archived
Delegated to: David Miller
Headers show

Commit Message

Marcelo Leitner Aug. 14, 2013, 1:53 p.m. UTC
This patch is based on 3.2.y branch, the one used by reported. Please let me
know if it should be different. Thanks.

---8<---

Commit 0d6a77079c475033cb622c07c5a880b392ef664e introduced a regression on
which routes to local delivery would not work anymore. Like this:

    $ ip -6 route add local 2001::/64 dev lo
    $ ping6 -c1 2001::9
    PING 2001::9(2001::9) 56 data bytes
    ping: sendmsg: Invalid argument

As this is a local delivery, that commit would not allow the creation of a
neighbor entry and thus the packet cannot be sent.

But as TPROXY scenario actually needs to avoid the neighbor entry creation only
for input flow, this patch now limits previous patch to input flow, keeping
output as before that patch.

Reported-by: Debabrata Banerjee <dbavatar@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
CC: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
 net/ipv6/route.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Comments

Hannes Frederic Sowa Aug. 14, 2013, 3 p.m. UTC | #1
On Wed, Aug 14, 2013 at 10:53:27AM -0300, Marcelo Ricardo Leitner wrote:
> This patch is based on 3.2.y branch, the one used by reported. Please let me
> know if it should be different. Thanks.
> 
> ---8<---
> 
> Commit 0d6a77079c475033cb622c07c5a880b392ef664e introduced a regression on
> which routes to local delivery would not work anymore. Like this:
> 
>     $ ip -6 route add local 2001::/64 dev lo
>     $ ping6 -c1 2001::9
>     PING 2001::9(2001::9) 56 data bytes
>     ping: sendmsg: Invalid argument
> 
> As this is a local delivery, that commit would not allow the creation of a
> neighbor entry and thus the packet cannot be sent.
> 
> But as TPROXY scenario actually needs to avoid the neighbor entry creation only
> for input flow, this patch now limits previous patch to input flow, keeping
> output as before that patch.
> 
> Reported-by: Debabrata Banerjee <dbavatar@gmail.com>
> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
> CC: Hannes Frederic Sowa <hannes@stressinduktion.org>

Looks good, thanks Marcelo!

Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

David, this patch is for all stable kernels except the 3.10 series.
It does not apply cleanly throughout the whole longterm kernels but the
changes should not be too difficult to adapt. Do you take care of this
or can we do something to ease this process?

Thanks!

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Aug. 15, 2013, 10:54 p.m. UTC | #2
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Wed, 14 Aug 2013 17:00:54 +0200

> On Wed, Aug 14, 2013 at 10:53:27AM -0300, Marcelo Ricardo Leitner wrote:
>> This patch is based on 3.2.y branch, the one used by reported. Please let me
>> know if it should be different. Thanks.
>> 
>> ---8<---
>> 
>> Commit 0d6a77079c475033cb622c07c5a880b392ef664e introduced a regression on
>> which routes to local delivery would not work anymore. Like this:
>> 
>>     $ ip -6 route add local 2001::/64 dev lo
>>     $ ping6 -c1 2001::9
>>     PING 2001::9(2001::9) 56 data bytes
>>     ping: sendmsg: Invalid argument
>> 
>> As this is a local delivery, that commit would not allow the creation of a
>> neighbor entry and thus the packet cannot be sent.
>> 
>> But as TPROXY scenario actually needs to avoid the neighbor entry creation only
>> for input flow, this patch now limits previous patch to input flow, keeping
>> output as before that patch.
>> 
>> Reported-by: Debabrata Banerjee <dbavatar@gmail.com>
>> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
>> CC: Hannes Frederic Sowa <hannes@stressinduktion.org>
> 
> Looks good, thanks Marcelo!
> 
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> 
> David, this patch is for all stable kernels except the 3.10 series.
> It does not apply cleanly throughout the whole longterm kernels but the
> changes should not be too difficult to adapt. Do you take care of this
> or can we do something to ease this process?

I've queued it up for -stable, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Pirko Aug. 28, 2013, 2:09 p.m. UTC | #3
Fri, Aug 16, 2013 at 12:54:54AM CEST, davem@davemloft.net wrote:
>From: Hannes Frederic Sowa <hannes@stressinduktion.org>
>Date: Wed, 14 Aug 2013 17:00:54 +0200
>
>> On Wed, Aug 14, 2013 at 10:53:27AM -0300, Marcelo Ricardo Leitner wrote:
>>> This patch is based on 3.2.y branch, the one used by reported. Please let me
>>> know if it should be different. Thanks.
>>> 
>>> ---8<---
>>> 
>>> Commit 0d6a77079c475033cb622c07c5a880b392ef664e introduced a regression on
>>> which routes to local delivery would not work anymore. Like this:
>>> 
>>>     $ ip -6 route add local 2001::/64 dev lo
>>>     $ ping6 -c1 2001::9
>>>     PING 2001::9(2001::9) 56 data bytes
>>>     ping: sendmsg: Invalid argument
>>> 
>>> As this is a local delivery, that commit would not allow the creation of a
>>> neighbor entry and thus the packet cannot be sent.
>>> 
>>> But as TPROXY scenario actually needs to avoid the neighbor entry creation only
>>> for input flow, this patch now limits previous patch to input flow, keeping
>>> output as before that patch.
>>> 
>>> Reported-by: Debabrata Banerjee <dbavatar@gmail.com>
>>> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
>>> CC: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> 
>> Looks good, thanks Marcelo!
>> 
>> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> 
>> David, this patch is for all stable kernels except the 3.10 series.
>> It does not apply cleanly throughout the whole longterm kernels but the
>> changes should not be too difficult to adapt. Do you take care of this
>> or can we do something to ease this process?
>
>I've queued it up for -stable, thanks.

Dave, is it possible to see the queue somewhere?

Thanks.

Jiri
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Hannes Frederic Sowa Aug. 28, 2013, 2:12 p.m. UTC | #4
On Wed, Aug 28, 2013 at 04:09:58PM +0200, Jiri Pirko wrote:
> Dave, is it possible to see the queue somewhere?

Here: <http://patchwork.ozlabs.org/bundle/davem/stable/?state=*>

Greetings,

  Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Pirko Aug. 29, 2013, 9:21 a.m. UTC | #5
Wed, Aug 28, 2013 at 04:12:31PM CEST, hannes@stressinduktion.org wrote:
>On Wed, Aug 28, 2013 at 04:09:58PM +0200, Jiri Pirko wrote:
>> Dave, is it possible to see the queue somewhere?
>
>Here: <http://patchwork.ozlabs.org/bundle/davem/stable/?state=*>
>
>Greetings,
>
>  Hannes
>

Great. Thanks.

ccing Ben.

Dave, Ben told me he did not receive this patch from you yet and
told me to bug you. So I'm doing that :)

Thanks

Jiri
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Pirko Sept. 9, 2013, 12:17 p.m. UTC | #6
Fri, Aug 16, 2013 at 12:54:54AM CEST, davem@davemloft.net wrote:
>From: Hannes Frederic Sowa <hannes@stressinduktion.org>
>Date: Wed, 14 Aug 2013 17:00:54 +0200
>
>> On Wed, Aug 14, 2013 at 10:53:27AM -0300, Marcelo Ricardo Leitner wrote:
>>> This patch is based on 3.2.y branch, the one used by reported. Please let me
>>> know if it should be different. Thanks.
>>> 
>>> ---8<---
>>> 
>>> Commit 0d6a77079c475033cb622c07c5a880b392ef664e introduced a regression on
>>> which routes to local delivery would not work anymore. Like this:
>>> 
>>>     $ ip -6 route add local 2001::/64 dev lo
>>>     $ ping6 -c1 2001::9
>>>     PING 2001::9(2001::9) 56 data bytes
>>>     ping: sendmsg: Invalid argument
>>> 
>>> As this is a local delivery, that commit would not allow the creation of a
>>> neighbor entry and thus the packet cannot be sent.
>>> 
>>> But as TPROXY scenario actually needs to avoid the neighbor entry creation only
>>> for input flow, this patch now limits previous patch to input flow, keeping
>>> output as before that patch.
>>> 
>>> Reported-by: Debabrata Banerjee <dbavatar@gmail.com>
>>> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
>>> CC: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> 
>> Looks good, thanks Marcelo!
>> 
>> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> 
>> David, this patch is for all stable kernels except the 3.10 series.
>> It does not apply cleanly throughout the whole longterm kernels but the
>> changes should not be too difficult to adapt. Do you take care of this
>> or can we do something to ease this process?
>
>I've queued it up for -stable, thanks.

Hi Dave.

When do you plan to push this to stable maintainers?

Thanks!

Jiri

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Sept. 9, 2013, 5:29 p.m. UTC | #7
From: Jiri Pirko <jiri@resnulli.us>
Date: Mon, 9 Sep 2013 14:17:19 +0200

> When do you plan to push this to stable maintainers?

Jiri, it's in the -stable queue and that means I will send it at an
appropriate time.

I'm working on a submission at the moment, but every extra query like
your's that I have to answer takes up time I could be spending on it.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jiri Pirko Sept. 16, 2013, 9:21 p.m. UTC | #8
Mon, Sep 09, 2013 at 07:29:00PM CEST, davem@davemloft.net wrote:
>From: Jiri Pirko <jiri@resnulli.us>
>Date: Mon, 9 Sep 2013 14:17:19 +0200
>
>> When do you plan to push this to stable maintainers?
>
>Jiri, it's in the -stable queue and that means I will send it at an
>appropriate time.
>
>I'm working on a submission at the moment, but every extra query like
>your's that I have to answer takes up time I could be spending on it.

I'm sorry Dave. I'm just worried. I don't want this patch to get lost.
I expected this patch to be part of:
http://git.kernel.org/cgit/linux/kernel/git/bwh/linux-3.2.y-queue.git/commit/?id=dadcb7672a124159630f1f756dea8323bc4976bd

But it is not there.

I'm sorry again :/

Jiri

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 18ea73c..bc9103d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -791,7 +791,7 @@  static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
 }
 
 static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
-				      struct flowi6 *fl6, int flags)
+				      struct flowi6 *fl6, int flags, bool input)
 {
 	struct fib6_node *fn;
 	struct rt6_info *rt, *nrt;
@@ -799,8 +799,11 @@  static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
 	int attempts = 3;
 	int err;
 	int reachable = net->ipv6.devconf_all->forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
+	int local = RTF_NONEXTHOP;
 
 	strict |= flags & RT6_LOOKUP_F_IFACE;
+	if (input)
+		local |= RTF_LOCAL;
 
 relookup:
 	read_lock_bh(&table->tb6_lock);
@@ -820,7 +823,7 @@  restart:
 	read_unlock_bh(&table->tb6_lock);
 
 	if (!dst_get_neighbour_raw(&rt->dst)
-	    && !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
+	    && !(rt->rt6i_flags & local))
 		nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
 	else if (!(rt->dst.flags & DST_HOST))
 		nrt = rt6_alloc_clone(rt, &fl6->daddr);
@@ -864,7 +867,7 @@  out2:
 static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
 					    struct flowi6 *fl6, int flags)
 {
-	return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
+	return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags, true);
 }
 
 void ip6_route_input(struct sk_buff *skb)
@@ -890,7 +893,7 @@  void ip6_route_input(struct sk_buff *skb)
 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
 					     struct flowi6 *fl6, int flags)
 {
-	return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
+	return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags, false);
 }
 
 struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,