Commit 26a41ae6 authored by stephen hemminger's avatar stephen hemminger Committed by David S. Miller

vxlan: only migrate dynamic FDB entries

Only migrate dynamic forwarding table entries, don't modify
static entries. If packet received from incorrect source IP address
assume it is an imposter and drop it.

This patch applies only to -net, a different patch would be needed for earlier
kernels since the NTF_SELF flag was introduced with 3.10.
Signed-off-by: default avatarStephen Hemminger <stephen@networkplumber.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3bf74b1a
...@@ -565,8 +565,9 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, ...@@ -565,8 +565,9 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
/* Watch incoming packets to learn mapping between Ethernet address /* Watch incoming packets to learn mapping between Ethernet address
* and Tunnel endpoint. * and Tunnel endpoint.
* Return true if packet is bogus and should be droppped.
*/ */
static void vxlan_snoop(struct net_device *dev, static bool vxlan_snoop(struct net_device *dev,
__be32 src_ip, const u8 *src_mac) __be32 src_ip, const u8 *src_mac)
{ {
struct vxlan_dev *vxlan = netdev_priv(dev); struct vxlan_dev *vxlan = netdev_priv(dev);
...@@ -575,7 +576,11 @@ static void vxlan_snoop(struct net_device *dev, ...@@ -575,7 +576,11 @@ static void vxlan_snoop(struct net_device *dev,
f = vxlan_find_mac(vxlan, src_mac); f = vxlan_find_mac(vxlan, src_mac);
if (likely(f)) { if (likely(f)) {
if (likely(f->remote.remote_ip == src_ip)) if (likely(f->remote.remote_ip == src_ip))
return; return false;
/* Don't migrate static entries, drop packets */
if (!(f->flags & NTF_SELF))
return true;
if (net_ratelimit()) if (net_ratelimit())
netdev_info(dev, netdev_info(dev,
...@@ -598,6 +603,8 @@ static void vxlan_snoop(struct net_device *dev, ...@@ -598,6 +603,8 @@ static void vxlan_snoop(struct net_device *dev,
0, NTF_SELF); 0, NTF_SELF);
spin_unlock(&vxlan->hash_lock); spin_unlock(&vxlan->hash_lock);
} }
return false;
} }
...@@ -729,8 +736,9 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb) ...@@ -729,8 +736,9 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
vxlan->dev->dev_addr) == 0) vxlan->dev->dev_addr) == 0)
goto drop; goto drop;
if (vxlan->flags & VXLAN_F_LEARN) if ((vxlan->flags & VXLAN_F_LEARN) &&
vxlan_snoop(skb->dev, oip->saddr, eth_hdr(skb)->h_source); vxlan_snoop(skb->dev, oip->saddr, eth_hdr(skb)->h_source))
goto drop;
__skb_tunnel_rx(skb, vxlan->dev); __skb_tunnel_rx(skb, vxlan->dev);
skb_reset_network_header(skb); skb_reset_network_header(skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment