From: Alexandre Derumier Date: Mon, 20 Aug 2018 15:13:19 +0000 (+0200) Subject: vrf patches X-Git-Url: https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff_plain;h=49b6d16422120bf40204c40729c17a72e177e690 vrf patches This fix https://github.com/FRRouting/frr/issues/2460 we can remove the workaround net.ipv4.tcp_l3mdev_accept=1 with this patches. --- diff --git a/patches/kernel/0012-net-udp-fix-SO_BINDTODEVICE.patch b/patches/kernel/0012-net-udp-fix-SO_BINDTODEVICE.patch new file mode 100644 index 0000000..144f192 --- /dev/null +++ b/patches/kernel/0012-net-udp-fix-SO_BINDTODEVICE.patch @@ -0,0 +1,67 @@ +From patchwork Wed May 9 10:42:34 2018 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [net] udp: fix SO_BINDTODEVICE +X-Patchwork-Submitter: Paolo Abeni +X-Patchwork-Id: 910747 +X-Patchwork-Delegate: davem@davemloft.net +Message-Id: <9445dd5d149af16463df4d0502b2667ee2b6f4e8.1525862461.git.pabeni@redhat.com> +To: netdev@vger.kernel.org +Cc: Damir Mansurov , David Ahern , + David Miller +Date: Wed, 9 May 2018 12:42:34 +0200 +From: Paolo Abeni +List-Id: + +Damir reported a breakage of SO_BINDTODEVICE for UDP sockets. +In absence of VRF devices, after commit fb74c27735f0 ("net: +ipv4: add second dif to udp socket lookups") the dif mismatch +isn't fatal anymore for UDP socket lookup with non null +sk_bound_dev_if, breaking SO_BINDTODEVICE semantics. + +This changeset addresses the issue making the dif match mandatory +again in the above scenario. + +Reported-by: Damir Mansurov +Fixes: fb74c27735f0 ("net: ipv4: add second dif to udp socket lookups") +Fixes: 1801b570dd2a ("net: ipv6: add second dif to udp socket lookups") +Signed-off-by: Paolo Abeni +Acked-by: David Ahern +--- + net/ipv4/udp.c | 4 ++-- + net/ipv6/udp.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 24b5c59b1c53..c2a292dfd137 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -401,9 +401,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score += 4; + } + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 4ec76a87aeb8..ea0730028e5d 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -148,9 +148,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score++; + } + diff --git a/patches/kernel/0013-net-net-tcp-Fix-socket-lookups-with-SO_BINDTODEVICE.patch b/patches/kernel/0013-net-net-tcp-Fix-socket-lookups-with-SO_BINDTODEVICE.patch new file mode 100644 index 0000000..5e90e09 --- /dev/null +++ b/patches/kernel/0013-net-net-tcp-Fix-socket-lookups-with-SO_BINDTODEVICE.patch @@ -0,0 +1,67 @@ +From patchwork Mon Jun 18 19:30:37 2018 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [net] net/tcp: Fix socket lookups with SO_BINDTODEVICE +X-Patchwork-Submitter: dsahern@kernel.org +X-Patchwork-Id: 931179 +X-Patchwork-Delegate: davem@davemloft.net +Message-Id: <20180618193037.3365-1-dsahern@kernel.org> +To: netdev@vger.kernel.org +Cc: davem@davemloft.net, lberger@labn.net, + renato@opensourcerouting.org, David Ahern +Date: Mon, 18 Jun 2018 12:30:37 -0700 +From: dsahern@kernel.org +List-Id: + +From: David Ahern + +Similar to 69678bcd4d2d ("udp: fix SO_BINDTODEVICE"), TCP socket lookups +need to fail if dev_match is not true. Currently, a packet to a given port +can match a socket bound to device when it should not. In the VRF case, +this causes the lookup to hit a VRF socket and not a global socket +resulting in a response trying to go through the VRF when it should it. + +Fixes: 3fa6f616a7a4d ("net: ipv4: add second dif to inet socket lookups") +Fixes: 4297a0ef08572 ("net: ipv6: add second dif to inet6 socket lookups") +Reported-by: Lou Berger +Diagnosed-by: Renato Westphal +Tested-by: Renato Westphal +Signed-off-by: David Ahern +--- + net/ipv4/inet_hashtables.c | 4 ++-- + net/ipv6/inet6_hashtables.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 31ff46daae97..3647167c8fa3 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -243,9 +243,9 @@ static inline int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score += 4; + } + if (sk->sk_incoming_cpu == raw_smp_processor_id()) +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index 2febe26de6a1..595ad408dba0 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -113,9 +113,9 @@ static inline int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score++; + } + if (sk->sk_incoming_cpu == raw_smp_processor_id())