vrf: check accept_source_route on the original netdevice

ssuryaextr · davem330 · commit 8c83f2df9c65 · 2019-04-01T10:44:58.000-07:00
Configuration check to accept source route IP options should be made on
the incoming netdevice when the skb-&gt;dev is an l3mdev master. The route
lookup for the source route next hop also needs the incoming netdev.

v2-&gt;v3:
- Simplify by passing the original netdevice down the stack (per David
  Ahern).

Signed-off-by: Stephen Suryaputra &lt;ssuryaextr@gmail.com&gt;
Reviewed-by: David Ahern &lt;dsahern@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/include/net/ip.h b/include/net/ip.h
@@ -677,7 +677,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
 			     unsigned char __user *data, int optlen);
 void ip_options_undo(struct ip_options *opt);
 void ip_forward_options(struct sk_buff *skb);
-int ip_options_rcv_srr(struct sk_buff *skb);
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev);
 
 /*
  *	Functions provided by ip_sockglue.c
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb)
 		       ip_local_deliver_finish);
 }
 
-static inline bool ip_rcv_options(struct sk_buff *skb)
+static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ip_options *opt;
 	const struct iphdr *iph;
-	struct net_device *dev = skb->dev;
 
 	/* It looks as overkill, because not all
 	   IP options require packet mangling.
@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)
 			}
 		}
 
-		if (ip_options_rcv_srr(skb))
+		if (ip_options_rcv_srr(skb, dev))
 			goto drop;
 	}
 
@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
 	}
 #endif
 
-	if (iph->ihl > 5 && ip_rcv_options(skb))
+	if (iph->ihl > 5 && ip_rcv_options(skb, dev))
 		goto drop;
 
 	rt = skb_rtable(skb);
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)
 	}
 }
 
-int ip_options_rcv_srr(struct sk_buff *skb)
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ip_options *opt = &(IPCB(skb)->opt);
 	int srrspace, srrptr;
@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 
 		orefdst = skb->_skb_refdst;
 		skb_dst_set(skb, NULL);
-		err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
+		err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);
 		rt2 = skb_rtable(skb);
 		if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
 			skb_dst_drop(skb);

Original file line number	Diff line number	Diff line change
`@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb)`
`257`	`257`	`ip_local_deliver_finish);`
`258`	`258`	`}`
`259`	`259`
`260`		`-static inline bool ip_rcv_options(struct sk_buff *skb)`
	`260`	`+static inline bool ip_rcv_options(struct sk_buff skb, struct net_device dev)`
`261`	`261`	`{`
`262`	`262`	`struct ip_options *opt;`
`263`	`263`	`const struct iphdr *iph;`
`264`		`- struct net_device *dev = skb->dev;`
`265`	`264`
`266`	`265`	`/* It looks as overkill, because not all`
`267`	`266`	`IP options require packet mangling.`
`@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)`
`297`	`296`	`}`
`298`	`297`	`}`
`299`	`298`
`300`		`- if (ip_options_rcv_srr(skb))`
	`299`	`+ if (ip_options_rcv_srr(skb, dev))`
`301`	`300`	`goto drop;`
`302`	`301`	`}`
`303`	`302`
`@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net net, struct sock sk,`
`353`	`352`	`}`
`354`	`353`	`#endif`
`355`	`354`
`356`		`- if (iph->ihl > 5 && ip_rcv_options(skb))`
	`355`	`+ if (iph->ihl > 5 && ip_rcv_options(skb, dev))`
`357`	`356`	`goto drop;`
`358`	`357`
`359`	`358`	`rt = skb_rtable(skb);`
Original file line number	Diff line number	Diff line change
`@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)`
`612`	`612`	`}`
`613`	`613`	`}`
`614`	`614`
`615`		`-int ip_options_rcv_srr(struct sk_buff *skb)`
	`615`	`+int ip_options_rcv_srr(struct sk_buff skb, struct net_device dev)`
`616`	`616`	`{`
`617`	`617`	`struct ip_options *opt = &(IPCB(skb)->opt);`
`618`	`618`	`int srrspace, srrptr;`
`@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)`
`647`	`647`
`648`	`648`	`orefdst = skb->_skb_refdst;`
`649`	`649`	`skb_dst_set(skb, NULL);`
`650`		`- err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);`
	`650`	`+ err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);`
`651`	`651`	`rt2 = skb_rtable(skb);`
`652`	`652`	`if (err \|\| (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {`
`653`	`653`	`skb_dst_drop(skb);`