public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed
From: Bart De Schuymer <bdschuym@pandora•be>
To: Florian Westphal <fw@strlen•de>, David Newall <davidn@davidnewall•com>
Cc: Stephen Hemminger <stephen@networkplumber•org>,
	Netdev <netdev@vger•kernel.org>,
	bridge@lists•linux-foundation.org,
	netfilter-devel@vger•kernel.org
Subject: Re: Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack)
Date: Mon, 19 May 2014 22:49:32 +0200	[thread overview]
Message-ID: <537A6E5C.6090602@pandora.be> (raw)
In-Reply-To: <20140519170915.GB24523@breakpoint.cc>

Florian Westphal schreef op 19/05/2014 19:09:
> David Newall <davidn@davidnewall•com> wrote:
>
> [ remove lkml and cc nf-devel ]
>
>> I tried to persevere with the commit: I recalculated checksum, which
>> left routes and times improperly updated in options.  Then I tried
>> calling ip_forward_options, which looks like it would correctly
>> update RR and TS (not to mention checksum)m but that bombed because
>> skb_rtable returned NULL.
>
> Yes.  bridge<->netfilter wiring is pure duct tape.
> The glue code will set up a fake rtable for the skb after the
> prerouting hook. [ see br_nf_pre_routing_finish() ].
>
>> I see three ways to progress:
>>
>> 1. Possibly call ip_forward_option, but that requires somebody who
>> understands this code to help;
>> 2. Just recalculate the checksum, leaving crap in the options; or
>> 3. Revert the commit.
>
> I think none of these are an option.
>
> I fail to understand why a bridge should honor/modifiy IP options.
>
> For the 'local delivery' case the ip stack will take care of
> option parsing, for forwarding it should be sufficient to do
> sanity tests (for netfilters sake).
>
>>From a quick glance, it should be sufficient to edit
> br_parse_ip_options() and remove everything after
>
> memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
>
> A 2nd step would be to move a copy of ip_options_compile()
> into br_netfilter.c and trim it down to only validate the
> ipv4 header without modifying it.

Perhaps it's possible to call ip_options_compile with a skb == NULL, 
like ip_options.c::ip_options_get_finish does. That way we don't need to 
duplicate code.
An alternative would be to make sure that the data pointed to by IPCB 
and BR_INPUT_SKB_CB don't overlap. If this were the case, we could 
indeed just revert the commit that was referred to.


cheers,
Bart

  reply	other threads:[~2014-05-19 20:49 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-05-11 14:41 Bad checksum on bridge with IP options David Newall
2014-05-11 19:42 ` Lukas Tribus
2014-05-12  8:14   ` David Newall
2014-05-12 10:15     ` Lukas Tribus
2014-05-12 10:25       ` David Newall
2014-05-12 10:31         ` Lukas Tribus
2014-05-12 10:48           ` David Newall
2014-05-12 13:23 ` David Newall
2014-05-12 13:51   ` Florian Westphal
2014-05-12 14:19     ` David Newall
2014-05-12 18:54   ` Lukas Tribus
2014-05-12 23:46     ` David Newall
2014-05-14 13:08       ` David Newall
2014-05-16 14:33         ` Revert 462fb2af9788a82a534f8184abfde31574e1cfa0 (bridge : Sanitize skb before it enters the IP stack) David Newall
2014-05-16 15:19           ` Eric Dumazet
2014-05-16 15:23             ` David Newall
2014-05-16 15:24             ` David Newall
2014-05-19 12:58           ` David Newall
2014-05-19 14:01             ` Florian Westphal
2014-05-19 14:19               ` David Newall
2014-05-19 17:09                 ` Florian Westphal
2014-05-19 20:49                   ` Bart De Schuymer [this message]
2014-05-21  7:49                     ` David Newall
2014-05-21 18:51                       ` Bart De Schuymer
2014-05-21 20:18                         ` David Miller
2014-05-22 18:57                           ` Bart De Schuymer
2014-05-24 18:00                             ` David Miller
2014-05-24  5:56                           ` David Newall
2014-05-24 17:43                             ` David Miller
2014-05-25  2:32                               ` David Newall
2014-05-25  3:02                                 ` David Miller
2014-05-25  6:37                                   ` David Newall
2014-05-27  8:55                                 ` David Laight
2014-05-29 22:34                                 ` David Miller
2014-05-30  9:17                                   ` David Newall
2014-05-31  0:46                                     ` David Miller
2014-05-31  6:13                                       ` David Newall
2014-05-31  6:37                                         ` David Miller
2014-05-22  3:50                         ` David Newall
2014-05-22 18:57                           ` Bart De Schuymer
2014-05-20  3:57                   ` David Newall
2014-05-20  4:55                 ` Valdis.Kletnieks
2014-05-20 16:05                   ` Vlad Yasevich
2014-05-21  8:10                   ` David Newall
2014-05-21 20:14                     ` David Miller
2014-05-22 20:06           ` Bandan Das

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=537A6E5C.6090602@pandora.be \
    --to=bdschuym@pandora$(echo .)be \
    --cc=bridge@lists$(echo .)linux-foundation.org \
    --cc=davidn@davidnewall$(echo .)com \
    --cc=fw@strlen$(echo .)de \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=netfilter-devel@vger$(echo .)kernel.org \
    --cc=stephen@networkplumber$(echo .)org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox