1. Patchew
  2. linux
  3. [PATCH 5.19 0000/1157] 5.19.2-rc1 review
  4. View patch

[PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key

Greg Kroah-Hartman posted 1157 patches 3 years, 1 month ago
Only 1155 patches received!
[PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key
Posted by Greg Kroah-Hartman 3 years, 1 month ago 
From: Paul Chaignon <paul@isovalent.com>

[ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]

Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
added support for getting and setting the outer source IP of encapsulated
packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
allows BPF programs to set any IP address as the source, including for
example the IP address of a container running on the same host.

In that last case, however, the encapsulated packets are dropped when
looking up the route because the source IP address isn't assigned to any
interface on the host. To avoid this, we need to set the
FLOWI_FLAG_ANYSRC flag.

Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
Signed-off-by: Paul Chaignon <paul@isovalent.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/76873d384e21288abe5767551a0799ac93ec07fb.1658759380.git.paul@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 7950f7520765..5978984b752f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4653,6 +4653,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
 	} else {
 		info->key.u.ipv4.dst = cpu_to_be32(from->remote_ipv4);
 		info->key.u.ipv4.src = cpu_to_be32(from->local_ipv4);
+		info->key.flow_flags = FLOWI_FLAG_ANYSRC;
 	}
 
 	return 0;
-- 
2.35.1
Re: [PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key
Posted by Paul Chaignon 3 years, 1 month ago 
On Mon, Aug 15, 2022 at 07:58:13PM +0200, Greg Kroah-Hartman wrote:
> From: Paul Chaignon <paul@isovalent.com>
> 
> [ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]
> 
> Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> added support for getting and setting the outer source IP of encapsulated
> packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> allows BPF programs to set any IP address as the source, including for
> example the IP address of a container running on the same host.
> 
> In that last case, however, the encapsulated packets are dropped when
> looking up the route because the source IP address isn't assigned to any
> interface on the host. To avoid this, we need to set the
> FLOWI_FLAG_ANYSRC flag.

This fix will also require upstream commits 861396ac0b47 ("geneve: Use
ip_tunnel_key flow flags in route lookups") and 7e2fb8bc7ef6 ("vxlan:
Use ip_tunnel_key flow flags in route lookups") to have the intended
effect. In short, these two commits "consume" the new field introduced
in 451ef36bd229 ("ip_tunnels: Add new flow flags field to
ip_tunnel_key") and populated in the present commit.

> 
> Fixes: 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> Signed-off-by: Paul Chaignon <paul@isovalent.com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
> Acked-by: Martin KaFai Lau <kafai@fb.com>
> Link: https://lore.kernel.org/bpf/76873d384e21288abe5767551a0799ac93ec07fb.1658759380.git.paul@isovalent.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  net/core/filter.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 7950f7520765..5978984b752f 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4653,6 +4653,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
>  	} else {
>  		info->key.u.ipv4.dst = cpu_to_be32(from->remote_ipv4);
>  		info->key.u.ipv4.src = cpu_to_be32(from->local_ipv4);
> +		info->key.flow_flags = FLOWI_FLAG_ANYSRC;
>  	}
>  
>  	return 0;
> -- 
> 2.35.1
> 
> 
>
Re: [PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key
Posted by Greg Kroah-Hartman 3 years, 1 month ago 
On Tue, Aug 16, 2022 at 04:35:54PM +0200, Paul Chaignon wrote:
> On Mon, Aug 15, 2022 at 07:58:13PM +0200, Greg Kroah-Hartman wrote:
> > From: Paul Chaignon <paul@isovalent.com>
> > 
> > [ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]
> > 
> > Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > added support for getting and setting the outer source IP of encapsulated
> > packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> > allows BPF programs to set any IP address as the source, including for
> > example the IP address of a container running on the same host.
> > 
> > In that last case, however, the encapsulated packets are dropped when
> > looking up the route because the source IP address isn't assigned to any
> > interface on the host. To avoid this, we need to set the
> > FLOWI_FLAG_ANYSRC flag.
> 
> This fix will also require upstream commits 861396ac0b47 ("geneve: Use
> ip_tunnel_key flow flags in route lookups") and 7e2fb8bc7ef6 ("vxlan:
> Use ip_tunnel_key flow flags in route lookups") to have the intended
> effect. In short, these two commits "consume" the new field introduced
> in 451ef36bd229 ("ip_tunnels: Add new flow flags field to
> ip_tunnel_key") and populated in the present commit.

Ick.  Is it better to just drop this commit instead?  Or is it ok to
also backport those 2 patches to 5.19.y?

thanks,

greg k-h
Re: [PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key
Posted by Paul Chaignon 3 years, 1 month ago 
On Tue, Aug 16, 2022 at 04:47:30PM +0200, Greg Kroah-Hartman wrote:
> On Tue, Aug 16, 2022 at 04:35:54PM +0200, Paul Chaignon wrote:
> > On Mon, Aug 15, 2022 at 07:58:13PM +0200, Greg Kroah-Hartman wrote:
> > > From: Paul Chaignon <paul@isovalent.com>
> > > 
> > > [ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]
> > > 
> > > Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > > added support for getting and setting the outer source IP of encapsulated
> > > packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> > > allows BPF programs to set any IP address as the source, including for
> > > example the IP address of a container running on the same host.
> > > 
> > > In that last case, however, the encapsulated packets are dropped when
> > > looking up the route because the source IP address isn't assigned to any
> > > interface on the host. To avoid this, we need to set the
> > > FLOWI_FLAG_ANYSRC flag.
> > 
> > This fix will also require upstream commits 861396ac0b47 ("geneve: Use
> > ip_tunnel_key flow flags in route lookups") and 7e2fb8bc7ef6 ("vxlan:
> > Use ip_tunnel_key flow flags in route lookups") to have the intended
> > effect. In short, these two commits "consume" the new field introduced
> > in 451ef36bd229 ("ip_tunnels: Add new flow flags field to
> > ip_tunnel_key") and populated in the present commit.
> 
> Ick.  Is it better to just drop this commit instead?  Or is it ok to
> also backport those 2 patches to 5.19.y?

It should be okay to backport those additional 2 patches to 5.19.y.

Thank you,

--
Paul
Re: [PATCH 5.19 0537/1157] bpf: Set flow flag to allow any source IP in bpf_tunnel_key
Posted by Greg Kroah-Hartman 3 years, 1 month ago 
On Tue, Aug 16, 2022 at 05:07:27PM +0200, Paul Chaignon wrote:
> On Tue, Aug 16, 2022 at 04:47:30PM +0200, Greg Kroah-Hartman wrote:
> > On Tue, Aug 16, 2022 at 04:35:54PM +0200, Paul Chaignon wrote:
> > > On Mon, Aug 15, 2022 at 07:58:13PM +0200, Greg Kroah-Hartman wrote:
> > > > From: Paul Chaignon <paul@isovalent.com>
> > > > 
> > > > [ Upstream commit b8fff748521c7178b9a7d32b5a34a81cec8396f3 ]
> > > > 
> > > > Commit 26101f5ab6bd ("bpf: Add source ip in "struct bpf_tunnel_key"")
> > > > added support for getting and setting the outer source IP of encapsulated
> > > > packets via the bpf_skb_{get,set}_tunnel_key BPF helper. This change
> > > > allows BPF programs to set any IP address as the source, including for
> > > > example the IP address of a container running on the same host.
> > > > 
> > > > In that last case, however, the encapsulated packets are dropped when
> > > > looking up the route because the source IP address isn't assigned to any
> > > > interface on the host. To avoid this, we need to set the
> > > > FLOWI_FLAG_ANYSRC flag.
> > > 
> > > This fix will also require upstream commits 861396ac0b47 ("geneve: Use
> > > ip_tunnel_key flow flags in route lookups") and 7e2fb8bc7ef6 ("vxlan:
> > > Use ip_tunnel_key flow flags in route lookups") to have the intended
> > > effect. In short, these two commits "consume" the new field introduced
> > > in 451ef36bd229 ("ip_tunnels: Add new flow flags field to
> > > ip_tunnel_key") and populated in the present commit.
> > 
> > Ick.  Is it better to just drop this commit instead?  Or is it ok to
> > also backport those 2 patches to 5.19.y?
> 
> It should be okay to backport those additional 2 patches to 5.19.y.

Thanks, both queued up now.

greg k-h

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.