1. 08 Nov, 2018 3 commits
    • Mike Manning's avatar
      net: ensure unbound datagram socket to be chosen when not in a VRF · 6da5b0f0
      Mike Manning authored
      Ensure an unbound datagram skt is chosen when not in a VRF. The check
      for a device match in compute_score() for UDP must be performed when
      there is no device match. For this, a failure is returned when there is
      no device match. This ensures that bound sockets are never selected,
      even if there is no unbound socket.
      
      Allow IPv6 packets to be sent over a datagram skt bound to a VRF. These
      packets are currently blocked, as flowi6_oif was set to that of the
      master vrf device, and the ipi6_ifindex is that of the slave device.
      Allow these packets to be sent by checking the device with ipi6_ifindex
      has the same L3 scope as that of the bound device of the skt, which is
      the master vrf device. Note that this check always succeeds if the skt
      is unbound.
      
      Even though the right datagram skt is now selected by compute_score(),
      a different skt is being returned that is bound to the wrong vrf. The
      difference between these and stream sockets is the handling of the skt
      option for SO_REUSEPORT. While the handling when adding a skt for reuse
      correctly checks that the bound device of the skt is a match, the skts
      in the hashslot are already incorrect. So for the same hash, a skt for
      the wrong vrf may be selected for the required port. The root cause is
      that the skt is immediately placed into a slot when it is created,
      but when the skt is then bound using SO_BINDTODEVICE, it remains in the
      same slot. The solution is to move the skt to the correct slot by
      forcing a rehash.
      Signed-off-by: default avatarMike Manning <mmanning@vyatta.att-mail.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Tested-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6da5b0f0
    • Mike Manning's avatar
      net: ensure unbound stream socket to be chosen when not in a VRF · e7819058
      Mike Manning authored
      The commit a04a480d ("net: Require exact match for TCP socket
      lookups if dif is l3mdev") only ensures that the correct socket is
      selected for packets in a VRF. However, there is no guarantee that
      the unbound socket will be selected for packets when not in a VRF.
      By checking for a device match in compute_score() also for the case
      when there is no bound device and attaching a score to this, the
      unbound socket is selected. And if a failure is returned when there
      is no device match, this ensures that bound sockets are never selected,
      even if there is no unbound socket.
      Signed-off-by: default avatarMike Manning <mmanning@vyatta.att-mail.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Tested-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e7819058
    • Robert Shearman's avatar
      net: allow binding socket in a VRF when there's an unbound socket · 3c82a21f
      Robert Shearman authored
      Change the inet socket lookup to avoid packets arriving on a device
      enslaved to an l3mdev from matching unbound sockets by removing the
      wildcard for non sk_bound_dev_if and instead relying on check against
      the secondary device index, which will be 0 when the input device is
      not enslaved to an l3mdev and so match against an unbound socket and
      not match when the input device is enslaved.
      
      Change the socket binding to take the l3mdev into account to allow an
      unbound socket to not conflict sockets bound to an l3mdev given the
      datapath isolation now guaranteed.
      Signed-off-by: default avatarRobert Shearman <rshearma@vyatta.att-mail.com>
      Signed-off-by: default avatarMike Manning <mmanning@vyatta.att-mail.com>
      Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
      Tested-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3c82a21f
  2. 07 Nov, 2018 22 commits
  3. 06 Nov, 2018 15 commits