Re: [PATCH net-next v3 02/10] net: ip: make fib_validate_source() return drop reason

On Mon, Oct 21, 2024 at 6:20 PM Paolo Abeni [off-list ref] wrote:

On 10/15/24 16:07, Menglong Dong wrote:

quoted

diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 90ff815f212b..b3f7a1562140 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h

@@ -452,13 +452,16 @@ int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                        dscp_t dscp, int oif, struct net_device *dev,
                        struct in_device *idev, u32 *itag);

-static inline int
+static inline enum skb_drop_reason
 fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                  dscp_t dscp, int oif, struct net_device *dev,
                  struct in_device *idev, u32 *itag)
 {
-     return __fib_validate_source(skb, src, dst, dscp, oif, dev, idev,
-                                  itag);
+     int err = __fib_validate_source(skb, src, dst, dscp, oif, dev, idev,
+                                     itag);
+     if (err < 0)
+             return -err;
+     return SKB_NOT_DROPPED_YET;
 }

It looks like the code churn in patch 1 is not needed??? You could just
define here a fib_validate_source_reason() helper doing the above, and
replace fib_validate_source with the the new helper as needed. Would
that work?

Of course, that works fine. I'm just trying to find a graceful way
for this part. Defining a fib_validate_source_reason() here looks
nice too, and we can ignore the 1st patch. I'll do it this way in
the next version.

Thanks!
Menglong Dong

quoted

@@ -1785,9 +1785,10 @@ static int __mkroute_input(struct sk_buff *skb, const struct fib_result *res,
              return -EINVAL;
      }

-     err = fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res),
-                               in_dev->dev, in_dev, &itag);
+     err = __fib_validate_source(skb, saddr, daddr, dscp, FIB_RES_OIF(*res),
+                                 in_dev->dev, in_dev, &itag);
      if (err < 0) {
+             err = -EINVAL;
              ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                       saddr);

I'm sorry for not noticing this issue before, but must preserve (at
least) the -EXDEV error code from the unpatched version or RP Filter MIB
accounting in ip_rcv_finish_core() will be fooled.

Thanks,

Paolo