github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: flowtable: release tunnel route on error when building forward path

Browse Source 
nft_flow_tunnel_update_route() can lazy fail, leaving an incomplete
forward path set ip. The route lookup also happens twice, once from
dev_fill_forward_path() and again in this aforementioned function.

Update ipip and ip6ip6 not to release the dst_entry and pass it on
via the tunnel forward path information.

In case of failure when setting up the forwarding path, release the
tunnel dst that was provided via dev_fill_forward_path().

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2026-07-28 18:30:55 +02:00
parent 0ad8404e77
commit 806273fcaf
3 changed files with 21 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/ipip.c
View File

@ -376,10 +376,10 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx,
path->tun.src_v4.s_addr = tiph->saddr;
path->tun.dst_v4.s_addr = tiph->daddr;
path->tun.l3_proto = IPPROTO_IPIP;
path->tun.dst = &rt->dst;
path->dev = ctx->dev;
ctx->dev = rt->dst.dev;
ip_rt_put(rt);
return 0;
}

4
net/ipv6/ip6_tunnel.c
View File

@ -1870,12 +1870,14 @@ static int ip6_tnl_fill_forward_path(struct net_device_path_ctx *ctx,
path->tun.src_v6 = fl6.saddr;
path->tun.dst_v6 = fl6.daddr;
path->tun.l3_proto = IPPROTO_IPV6;
path->tun.dst = dst;
path->dev = ctx->dev;
ctx->dev = dst->dev;
}
err = dst->error;
dst_release(dst);
if (err)
dst_release(dst);
return err;
}

65
net/netfilter/nf_flow_table_path.c
View File

@ -82,6 +82,7 @@ struct nft_forward_info {
} encap[NF_FLOW_TABLE_ENCAP_MAX];
u8 num_encaps;
struct flow_offload_tunnel tun;
struct dst_entry *tun_dst;
u8 num_tuns;
u8 ingress_vlans;
u8 h_source[ETH_ALEN];
@ -93,7 +94,7 @@ struct nft_forward_info {
static bool nft_flowtable_find_dev(const struct net_device *dev,
struct nft_flowtable *ft);
static int nft_dev_path_info(const struct net_device_path_stack *stack,
static int nft_dev_path_info(struct net_device_path_stack *stack,
struct nft_forward_info *info,
unsigned char *ha, struct nft_flowtable *ft)
{
@ -121,15 +122,16 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
/* DEV_PATH_VLAN, DEV_PATH_PPPOE and DEV_PATH_TUN */
if (path->type == DEV_PATH_TUN) {
if (info->num_tuns)
return -1;
goto err_out;
info->tun.src_v6 = path->tun.src_v6;
info->tun.dst_v6 = path->tun.dst_v6;
info->tun.l3_proto = path->tun.l3_proto;
info->tun_dst = path->tun.dst;
info->num_tuns++;
} else {
if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
return -1;
goto err_out;
info->encap[info->num_encaps].id =
path->encap.id;
@ -150,13 +152,13 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
switch (path->bridge.vlan_mode) {
case DEV_PATH_BR_VLAN_UNTAG_HW:
if (info->num_encaps == 0)
return -1;
goto err_out;
info->ingress_vlans |= BIT(info->num_encaps - 1);
break;
case DEV_PATH_BR_VLAN_TAG:
if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
return -1;
goto err_out;
info->encap[info->num_encaps].id = path->bridge.vlan_id;
info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
@ -164,7 +166,7 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
break;
case DEV_PATH_BR_VLAN_UNTAG:
if (info->num_encaps == 0)
return -1;
goto err_out;
info->num_encaps--;
break;
@ -174,7 +176,7 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
break;
default:
return -1;
goto err_out;
}
}
@ -183,9 +185,13 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
if (!nft_flowtable_find_dev(info->dev, ft))
return -1;
goto err_out;
return 0;
err_out:
dev_fill_forward_path_release(stack);
return -1;
}
static bool nft_flowtable_find_dev(const struct net_device *dev,
@ -205,44 +211,6 @@ static bool nft_flowtable_find_dev(const struct net_device *dev,
return found;
}
static int nft_flow_tunnel_update_route(const struct nft_pktinfo *pkt,
struct flow_offload_tunnel *tun,
struct nf_flow_route *route,
enum ip_conntrack_dir dir)
{
struct dst_entry *cur_dst = route->tuple[dir].dst;
struct dst_entry *tun_dst = NULL;
struct flowi fl = {};
switch (nft_pf(pkt)) {
case NFPROTO_IPV4:
fl.u.ip4.daddr = tun->dst_v4.s_addr;
fl.u.ip4.saddr = tun->src_v4.s_addr;
fl.u.ip4.flowi4_iif = nft_in(pkt)->ifindex;
fl.u.ip4.flowi4_dscp = ip4h_dscp(ip_hdr(pkt->skb));
fl.u.ip4.flowi4_mark = pkt->skb->mark;
fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC;
break;
case NFPROTO_IPV6:
fl.u.ip6.daddr = tun->dst_v6;
fl.u.ip6.saddr = tun->src_v6;
fl.u.ip6.flowi6_iif = nft_in(pkt)->ifindex;
fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(pkt->skb));
fl.u.ip6.flowi6_mark = pkt->skb->mark;
fl.u.ip6.flowi6_flags = FLOWI_FLAG_ANYSRC;
break;
}
nf_route(nft_net(pkt), &tun_dst, &fl, false, nft_pf(pkt));
if (!tun_dst)
return -ENOENT;
route->tuple[dir].dst = tun_dst;
dst_release(cur_dst);
return 0;
}
static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
struct nf_flow_route *route,
const struct nf_conn *ct,
@ -267,12 +235,13 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
route->tuple[!dir].in.encap[i].proto = info.encap[i].proto;
}
if (info.num_tuns &&
!nft_flow_tunnel_update_route(pkt, &info.tun, route, dir)) {
if (info.num_tuns) {
route->tuple[!dir].in.tun.src_v6 = info.tun.dst_v6;
route->tuple[!dir].in.tun.dst_v6 = info.tun.src_v6;
route->tuple[!dir].in.tun.l3_proto = info.tun.l3_proto;
route->tuple[!dir].in.num_tuns = info.num_tuns;
dst_release(route->tuple[dir].dst);
route->tuple[dir].dst = info.tun_dst;
}
route->tuple[!dir].in.num_encaps = info.num_encaps;