Commit 7ec9fce4 authored by Eyal Birger's avatar Eyal Birger Committed by Daniel Borkmann
Browse files

ip_tunnel: Respect tunnel key's "flow_flags" in IP tunnels 



Commit 451ef36b ("ip_tunnels: Add new flow flags field to ip_tunnel_key")
added a "flow_flags" member to struct ip_tunnel_key which was later used by
the commit in the fixes tag to avoid dropping packets with sources that
aren't locally configured when set in bpf_set_tunnel_key().

VXLAN and GENEVE were made to respect this flag, ip tunnels like IPIP and GRE
were not.

This commit fixes this omission by making ip_tunnel_init_flow() receive
the flow flags from the tunnel key in the relevant collect_md paths.

Fixes: b8fff748 ("bpf: Set flow flag to allow any source IP in bpf_tunnel_key")
Signed-off-by: default avatarEyal Birger <eyal.birger@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarPaul Chaignon <paul@isovalent.com>
Link: https://lore.kernel.org/bpf/20220818074118.726639-1-eyal.birger@gmail.com
parent 14b20b78

drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c

+2 −1
Original line number Diff line number Diff line
@@ -423,7 +423,8 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, 


	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);

	ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp,

			    0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0);

			    0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0,

			    0);



	rt = ip_route_output_key(tun->net, &fl4);

	if (IS_ERR(rt))

include/net/ip_tunnels.h

+3 −1
Original line number Diff line number Diff line
@@ -246,7 +246,8 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, 
				       __be32 daddr, __be32 saddr,

				       __be32 key, __u8 tos,

				       struct net *net, int oif,

				       __u32 mark, __u32 tun_inner_hash)

				       __u32 mark, __u32 tun_inner_hash,

				       __u8 flow_flags)

{

	memset(fl4, 0, sizeof(*fl4));
@@ -263,6 +264,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, 
	fl4->fl4_gre_key = key;

	fl4->flowi4_mark = mark;

	fl4->flowi4_multipath_hash = tun_inner_hash;

	fl4->flowi4_flags = flow_flags;

}



int ip_tunnel_init(struct net_device *dev);

net/ipv4/ip_gre.c

+1 −1
Original line number Diff line number Diff line
@@ -609,7 +609,7 @@ static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) 
	ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,

			    tunnel_id_to_key32(key->tun_id),

			    key->tos & ~INET_ECN_MASK, dev_net(dev), 0,

			    skb->mark, skb_get_hash(skb));

			    skb->mark, skb_get_hash(skb), key->flow_flags);

	rt = ip_route_output_key(dev_net(dev), &fl4);

	if (IS_ERR(rt))

		return PTR_ERR(rt);

net/ipv4/ip_tunnel.c

+4 −3
Original line number Diff line number Diff line
@@ -295,7 +295,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) 
		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,

				    iph->saddr, tunnel->parms.o_key,

				    RT_TOS(iph->tos), dev_net(dev),

				    tunnel->parms.link, tunnel->fwmark, 0);

				    tunnel->parms.link, tunnel->fwmark, 0, 0);

		rt = ip_route_output_key(tunnel->net, &fl4);



		if (!IS_ERR(rt)) {
@@ -570,7 +570,8 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
	}

	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,

			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),

			    dev_net(dev), 0, skb->mark, skb_get_hash(skb));

			    dev_net(dev), 0, skb->mark, skb_get_hash(skb),

			    key->flow_flags);

	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)

		goto tx_error;
@@ -729,7 +730,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,

			    tunnel->parms.o_key, RT_TOS(tos),

			    dev_net(dev), tunnel->parms.link,

			    tunnel->fwmark, skb_get_hash(skb));

			    tunnel->fwmark, skb_get_hash(skb), 0);



	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)

		goto tx_error;