Revision 8d2b51b008c25240914984208b2ced57d1dd25a5 authored by Guillaume Nault on 16 January 2021, 10:44:22 UTC, committed by Jakub Kicinski on 19 January 2021, 21:54:30 UTC
udp_v4_early_demux() is the only function that calls ip_mc_validate_source() with a TOS that hasn't been masked with IPTOS_RT_MASK. This results in different behaviours for incoming multicast UDPv4 packets, depending on if ip_mc_validate_source() is called from the early-demux path (udp_v4_early_demux) or from the regular input path (ip_route_input_noref). ECN would normally not be used with UDP multicast packets, so the practical consequences should be limited on that side. However, IPTOS_RT_MASK is used to also masks the TOS' high order bits, to align with the non-early-demux path behaviour. Reproducer: Setup two netns, connected with veth: $ ip netns add ns0 $ ip netns add ns1 $ ip -netns ns0 link set dev lo up $ ip -netns ns1 link set dev lo up $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 $ ip -netns ns0 link set dev veth01 up $ ip -netns ns1 link set dev veth10 up $ ip -netns ns0 address add 192.0.2.10 peer 192.0.2.11/32 dev veth01 $ ip -netns ns1 address add 192.0.2.11 peer 192.0.2.10/32 dev veth10 In ns0, add route to multicast address 224.0.2.0/24 using source address 198.51.100.10: $ ip -netns ns0 address add 198.51.100.10/32 dev lo $ ip -netns ns0 route add 224.0.2.0/24 dev veth01 src 198.51.100.10 In ns1, define route to 198.51.100.10, only for packets with TOS 4: $ ip -netns ns1 route add 198.51.100.10/32 tos 4 dev veth10 Also activate rp_filter in ns1, so that incoming packets not matching the above route get dropped: $ ip netns exec ns1 sysctl -wq net.ipv4.conf.veth10.rp_filter=1 Now try to receive packets on 224.0.2.11: $ ip netns exec ns1 socat UDP-RECVFROM:1111,ip-add-membership=224.0.2.11:veth10,ignoreeof - In ns0, send packet to 224.0.2.11 with TOS 4 and ECT(0) (that is, tos 6 for socat): $ echo test0 | ip netns exec ns0 socat - UDP-DATAGRAM:224.0.2.11:1111,bind=:1111,tos=6 The "test0" message is properly received by socat in ns1, because early-demux has no cached dst to use, so source address validation is done by ip_route_input_mc(), which receives a TOS that has the ECN bits masked. Now send another packet to 224.0.2.11, still with TOS 4 and ECT(0): $ echo test1 | ip netns exec ns0 socat - UDP-DATAGRAM:224.0.2.11:1111,bind=:1111,tos=6 The "test1" message isn't received by socat in ns1, because, now, early-demux has a cached dst to use and calls ip_mc_validate_source() immediately, without masking the ECN bits. Fixes: bc044e8db796 ("udp: perform source validation for mcast early demux") Signed-off-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent f7b9820
File | Mode | Size |
---|---|---|
asymmetric_keys | ||
async_tx | ||
842.c | -rw-r--r-- | 3.7 KB |
Kconfig | -rw-r--r-- | 56.2 KB |
Makefile | -rw-r--r-- | 7.6 KB |
acompress.c | -rw-r--r-- | 4.7 KB |
adiantum.c | -rw-r--r-- | 19.4 KB |
aead.c | -rw-r--r-- | 7.2 KB |
aegis.h | -rw-r--r-- | 1.8 KB |
aegis128-core.c | -rw-r--r-- | 16.2 KB |
aegis128-neon-inner.c | -rw-r--r-- | 8.4 KB |
aegis128-neon.c | -rw-r--r-- | 2.0 KB |
aes_generic.c | -rw-r--r-- | 57.6 KB |
aes_ti.c | -rw-r--r-- | 2.0 KB |
af_alg.c | -rw-r--r-- | 26.3 KB |
ahash.c | -rw-r--r-- | 15.7 KB |
akcipher.c | -rw-r--r-- | 4.0 KB |
algapi.c | -rw-r--r-- | 29.5 KB |
algboss.c | -rw-r--r-- | 5.9 KB |
algif_aead.c | -rw-r--r-- | 15.6 KB |
algif_hash.c | -rw-r--r-- | 9.5 KB |
algif_rng.c | -rw-r--r-- | 8.4 KB |
algif_skcipher.c | -rw-r--r-- | 9.6 KB |
ansi_cprng.c | -rw-r--r-- | 10.7 KB |
anubis.c | -rw-r--r-- | 27.8 KB |
api.c | -rw-r--r-- | 13.8 KB |
arc4.c | -rw-r--r-- | 2.1 KB |
authenc.c | -rw-r--r-- | 13.1 KB |
authencesn.c | -rw-r--r-- | 14.2 KB |
blake2b_generic.c | -rw-r--r-- | 9.3 KB |
blake2s_generic.c | -rw-r--r-- | 5.0 KB |
blowfish_common.c | -rw-r--r-- | 15.5 KB |
blowfish_generic.c | -rw-r--r-- | 3.2 KB |
camellia_generic.c | -rw-r--r-- | 34.2 KB |
cast5_generic.c | -rw-r--r-- | 20.5 KB |
cast6_generic.c | -rw-r--r-- | 9.1 KB |
cast_common.c | -rw-r--r-- | 12.9 KB |
cbc.c | -rw-r--r-- | 5.1 KB |
ccm.c | -rw-r--r-- | 23.4 KB |
cfb.c | -rw-r--r-- | 6.1 KB |
chacha20poly1305.c | -rw-r--r-- | 17.7 KB |
chacha_generic.c | -rw-r--r-- | 3.9 KB |
cipher.c | -rw-r--r-- | 2.5 KB |
cmac.c | -rw-r--r-- | 7.5 KB |
compress.c | -rw-r--r-- | 921 bytes |
crc32_generic.c | -rw-r--r-- | 3.7 KB |
crc32c_generic.c | -rw-r--r-- | 4.1 KB |
crct10dif_common.c | -rw-r--r-- | 3.6 KB |
crct10dif_generic.c | -rw-r--r-- | 3.1 KB |
cryptd.c | -rw-r--r-- | 28.6 KB |
crypto_engine.c | -rw-r--r-- | 15.3 KB |
crypto_null.c | -rw-r--r-- | 5.3 KB |
crypto_user_base.c | -rw-r--r-- | 12.0 KB |
crypto_user_stat.c | -rw-r--r-- | 9.6 KB |
ctr.c | -rw-r--r-- | 9.5 KB |
cts.c | -rw-r--r-- | 11.5 KB |
curve25519-generic.c | -rw-r--r-- | 2.2 KB |
deflate.c | -rw-r--r-- | 7.7 KB |
des_generic.c | -rw-r--r-- | 3.3 KB |
dh.c | -rw-r--r-- | 5.4 KB |
dh_helper.c | -rw-r--r-- | 3.4 KB |
drbg.c | -rw-r--r-- | 59.7 KB |
ecb.c | -rw-r--r-- | 2.4 KB |
ecc.c | -rw-r--r-- | 39.0 KB |
ecc.h | -rw-r--r-- | 8.0 KB |
ecc_curve_defs.h | -rw-r--r-- | 1.9 KB |
ecdh.c | -rw-r--r-- | 4.0 KB |
ecdh_helper.c | -rw-r--r-- | 2.1 KB |
echainiv.c | -rw-r--r-- | 4.1 KB |
ecrdsa.c | -rw-r--r-- | 8.4 KB |
ecrdsa_defs.h | -rw-r--r-- | 7.2 KB |
ecrdsa_params.asn1 | -rw-r--r-- | 142 bytes |
ecrdsa_pub_key.asn1 | -rw-r--r-- | 57 bytes |
essiv.c | -rw-r--r-- | 17.8 KB |
fcrypt.c | -rw-r--r-- | 18.0 KB |
fips.c | -rw-r--r-- | 1.7 KB |
gcm.c | -rw-r--r-- | 30.0 KB |
geniv.c | -rw-r--r-- | 3.8 KB |
gf128mul.c | -rw-r--r-- | 12.5 KB |
ghash-generic.c | -rw-r--r-- | 4.8 KB |
hash_info.c | -rw-r--r-- | 1.9 KB |
hmac.c | -rw-r--r-- | 6.4 KB |
internal.h | -rw-r--r-- | 3.8 KB |
jitterentropy-kcapi.c | -rw-r--r-- | 6.2 KB |
jitterentropy.c | -rw-r--r-- | 25.2 KB |
jitterentropy.h | -rw-r--r-- | 643 bytes |
keywrap.c | -rw-r--r-- | 9.5 KB |
khazad.c | -rw-r--r-- | 51.8 KB |
kpp.c | -rw-r--r-- | 2.7 KB |
lrw.c | -rw-r--r-- | 10.6 KB |
lz4.c | -rw-r--r-- | 3.3 KB |
lz4hc.c | -rw-r--r-- | 3.4 KB |
lzo-rle.c | -rw-r--r-- | 3.4 KB |
lzo.c | -rw-r--r-- | 3.3 KB |
md4.c | -rw-r--r-- | 5.9 KB |
md5.c | -rw-r--r-- | 7.4 KB |
memneq.c | -rw-r--r-- | 6.1 KB |
michael_mic.c | -rw-r--r-- | 3.5 KB |
nhpoly1305.c | -rw-r--r-- | 7.8 KB |
ofb.c | -rw-r--r-- | 2.4 KB |
pcbc.c | -rw-r--r-- | 4.6 KB |
pcrypt.c | -rw-r--r-- | 9.2 KB |
poly1305_generic.c | -rw-r--r-- | 3.7 KB |
proc.c | -rw-r--r-- | 2.5 KB |
ripemd.h | -rw-r--r-- | 1013 bytes |
rmd128.c | -rw-r--r-- | 10.0 KB |
rmd160.c | -rw-r--r-- | 12.4 KB |
rmd256.c | -rw-r--r-- | 10.3 KB |
rmd320.c | -rw-r--r-- | 12.8 KB |
rng.c | -rw-r--r-- | 4.8 KB |
rsa-pkcs1pad.c | -rw-r--r-- | 17.3 KB |
rsa.c | -rw-r--r-- | 5.3 KB |
rsa_helper.c | -rw-r--r-- | 4.0 KB |
rsaprivkey.asn1 | -rw-r--r-- | 316 bytes |
rsapubkey.asn1 | -rw-r--r-- | 82 bytes |
salsa20_generic.c | -rw-r--r-- | 6.0 KB |
scatterwalk.c | -rw-r--r-- | 2.0 KB |
scompress.c | -rw-r--r-- | 6.8 KB |
seed.c | -rw-r--r-- | 17.2 KB |
seqiv.c | -rw-r--r-- | 4.5 KB |
serpent_generic.c | -rw-r--r-- | 21.5 KB |
sha1_generic.c | -rw-r--r-- | 2.3 KB |
sha256_generic.c | -rw-r--r-- | 3.3 KB |
sha3_generic.c | -rw-r--r-- | 8.0 KB |
sha512_generic.c | -rw-r--r-- | 7.8 KB |
shash.c | -rw-r--r-- | 15.1 KB |
simd.c | -rw-r--r-- | 13.5 KB |
skcipher.c | -rw-r--r-- | 24.8 KB |
sm2.c | -rw-r--r-- | 9.8 KB |
sm2signature.asn1 | -rw-r--r-- | 113 bytes |
sm3_generic.c | -rw-r--r-- | 4.1 KB |
sm4_generic.c | -rw-r--r-- | 6.2 KB |
streebog_generic.c | -rw-r--r-- | 57.6 KB |
tcrypt.c | -rw-r--r-- | 78.6 KB |
tcrypt.h | -rw-r--r-- | 3.0 KB |
tea.c | -rw-r--r-- | 6.5 KB |
testmgr.c | -rw-r--r-- | 145.1 KB |
testmgr.h | -rw-r--r-- | 1.2 MB |
tgr192.c | -rw-r--r-- | 30.3 KB |
twofish_common.c | -rw-r--r-- | 37.1 KB |
twofish_generic.c | -rw-r--r-- | 5.6 KB |
vmac.c | -rw-r--r-- | 18.8 KB |
wp512.c | -rw-r--r-- | 59.8 KB |
xcbc.c | -rw-r--r-- | 6.7 KB |
xor.c | -rw-r--r-- | 3.7 KB |
xts.c | -rw-r--r-- | 11.7 KB |
xxhash_generic.c | -rw-r--r-- | 2.4 KB |
zstd.c | -rw-r--r-- | 5.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...