mbox series

[net,0/2] net: Fix looping with vrf, xfrms and qdisc on VRF

Message ID 20200420231352.50855-1-dsahern@kernel.org
Headers show
Series net: Fix looping with vrf, xfrms and qdisc on VRF | expand

Message

David Ahern April 20, 2020, 11:13 p.m. UTC 
From: David Ahern <dsahern@gmail.com>

Trev reported that use of VRFs with xfrms is looping when a qdisc
is added to the VRF device. The combination of xfrm + qdisc is not
handled by the VRF driver which lost track that it has already
seen the packet.

The XFRM_TRANSFORMED flag is used by the netfilter code for a similar
purpose, so re-use for VRF. Patch 1 drops the #ifdef around setting
the flag in the xfrm output functions. Patch 2 adds a check to
the VRF driver for flag; if set the packet has already passed through
the VRF driver once and does not need to recirculated a second time.

This is a day 1 bug with VRFs; stable wise, I would only take this
back to 4.14. I have a set of test cases which I will submit to
net-next.

David Ahern (2):
  xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
  vrf: Check skb for XFRM_TRANSFORMED flag

 drivers/net/vrf.c       | 6 ++++--
 net/ipv4/xfrm4_output.c | 2 --
 net/ipv6/xfrm6_output.c | 2 --
 3 files changed, 4 insertions(+), 6 deletions(-)