Commit f92ee619 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm: Generate blackhole routes only from route lookup functions 



Currently we genarate a blackhole route route whenever we have
matching policies but can not resolve the states. Here we assume
that dst_output() is called to kill the balckholed packets.
Unfortunately this assumption is not true in all cases, so
it is possible that these packets leave the system unwanted.

We fix this by generating blackhole routes only from the
route lookup functions, here we can guarantee a call to
dst_output() afterwards.

Fixes: 2774c131 ("xfrm: Handle blackhole route creation via afinfo.")
Reported-by: default avatarKonstantinos Kolelis <k.kolelis@sirrix.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 95cd6f48

include/net/dst.h

+14 −1
Original line number Diff line number Diff line
@@ -492,6 +492,15 @@ static inline struct dst_entry *xfrm_lookup(struct net *net, 
	return dst_orig;

}



static inline struct dst_entry *xfrm_lookup_route(struct net *net,

						  struct dst_entry *dst_orig,

						  const struct flowi *fl,

						  struct sock *sk,

						  int flags)

{

	return dst_orig;

}



static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)

{

	return NULL;
@@ -502,6 +511,10 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig, 
			      const struct flowi *fl, struct sock *sk,

			      int flags);



struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,

				    const struct flowi *fl, struct sock *sk,

				    int flags);



/* skb attached with this dst needs transformation if dst->xfrm is valid */

static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)

{

net/ipv4/route.c

+3 −3
Original line number Diff line number Diff line
@@ -2265,7 +2265,7 @@ struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4, 
		return rt;



	if (flp4->flowi4_proto)

		rt = (struct rtable *) xfrm_lookup(net, &rt->dst,

		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,

							flowi4_to_flowi(flp4),

							sk, 0);

net/ipv6/ip6_output.c

+2 −2
Original line number Diff line number Diff line
@@ -1009,7 +1009,7 @@ struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, 
	if (final_dst)

		fl6->daddr = *final_dst;



	return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);

	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);

}

EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
@@ -1041,7 +1041,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, 
	if (final_dst)

		fl6->daddr = *final_dst;



	return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);

	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);

}

EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);

net/xfrm/xfrm_policy.c

+17 −1
Original line number Diff line number Diff line
@@ -2138,7 +2138,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig, 
			xfrm_pols_put(pols, drop_pols);

			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);



			return make_blackhole(net, family, dst_orig);

			return ERR_PTR(-EREMOTE);

		}



		err = -EAGAIN;
@@ -2195,6 +2195,22 @@ dropdst: 
}

EXPORT_SYMBOL(xfrm_lookup);



/* Callers of xfrm_lookup_route() must ensure a call to dst_output().

 * Otherwise we may send out blackholed packets.

 */

struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,

				    const struct flowi *fl,

				    struct sock *sk, int flags)

{

	struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk, flags);



	if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)

		return make_blackhole(net, dst_orig->ops->family, dst_orig);



	return dst;

}

EXPORT_SYMBOL(xfrm_lookup_route);



static inline int

xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)

{

CRA Git | Maintained and supported by SUSTech CRA and CCSE