Commit bc8fc7b8 authored Aug 14, 2014 by Shmulik Ladkani Committed by David S. Miller Aug 14, 2014

sit: Fix ipip6_tunnel_lookup device matching criteria



As of 4fddbf5d ("sit: strictly restrict incoming traffic to tunnel link device"),
when looking up a tunnel, tunnel's underlying interface (t->parms.link)
is verified to match incoming traffic's ingress device.

However the comparison was incorrectly based on skb->dev->iflink.

Instead, dev->ifindex should be used, which correctly represents the
interface from which the IP stack hands the ipip6 packets.

This allows setting up sit tunnels bound to vlan interfaces (otherwise
incoming ipip6 traffic on the vlan interface was dropped due to
ipip6_tunnel_lookup match failure).

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3b3e0ea8

net/ipv6/sit.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -101,19 +101,19 @@ static struct ip_tunnel ipip6_tunnel_lookup(struct net net,
		for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
		if (local == t->parms.iph.saddr &&
		remote == t->parms.iph.daddr &&
		(!dev \|\| !t->parms.link \|\| dev->iflink == t->parms.link) &&
		(!dev \|\| !t->parms.link \|\| dev->ifindex == t->parms.link) &&
		(t->dev->flags & IFF_UP))
		return t;
		}
		for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
		if (remote == t->parms.iph.daddr &&
		(!dev \|\| !t->parms.link \|\| dev->iflink == t->parms.link) &&
		(!dev \|\| !t->parms.link \|\| dev->ifindex == t->parms.link) &&
		(t->dev->flags & IFF_UP))
		return t;
		}
		for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
		if (local == t->parms.iph.saddr &&
		(!dev \|\| !t->parms.link \|\| dev->iflink == t->parms.link) &&
		(!dev \|\| !t->parms.link \|\| dev->ifindex == t->parms.link) &&
		(t->dev->flags & IFF_UP))
		return t;
		}

Admin message