Re: [PATCH net-next v3 02/10] net: ip: make fib_validate_source() return drop reason
From: Paolo Abeni <pabeni@redhat.com>
Date: 2024-10-21 10:20:38
Also in:
bpf, bridge, lkml, netfilter-devel
On 10/15/24 16:07, Menglong Dong wrote:
quoted hunk ↗ jump to hunk
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index 90ff815f212b..b3f7a1562140 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h@@ -452,13 +452,16 @@ int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, dscp_t dscp, int oif, struct net_device *dev, struct in_device *idev, u32 *itag); -static inline int +static inline enum skb_drop_reason fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, dscp_t dscp, int oif, struct net_device *dev, struct in_device *idev, u32 *itag) { - return __fib_validate_source(skb, src, dst, dscp, oif, dev, idev, - itag); + int err = __fib_validate_source(skb, src, dst, dscp, oif, dev, idev, + itag); + if (err < 0) + return -err; + return SKB_NOT_DROPPED_YET; }
It looks like the code churn in patch 1 is not needed??? You could just define here a fib_validate_source_reason() helper doing the above, and replace fib_validate_source with the the new helper as needed. Would that work?
quoted hunk ↗ jump to hunk
@@ -1785,9 +1785,10 @@ static int __mkroute_input(struct sk_buff *skb, const struct fib_result *res, return -EINVAL; } - err = fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res), - in_dev->dev, in_dev, &itag); + err = __fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res), + in_dev->dev, in_dev, &itag); if (err < 0) { + err = -EINVAL; ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr, saddr);
I'm sorry for not noticing this issue before, but must preserve (at least) the -EXDEV error code from the unpatched version or RP Filter MIB accounting in ip_rcv_finish_core() will be fooled. Thanks, Paolo