]> www.infradead.org Git - users/dwmw2/linux.git/commit
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
authorMike Manning <mvrmanning@gmail.com>
Mon, 25 Jul 2022 18:14:42 +0000 (19:14 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 21 Aug 2022 13:15:51 +0000 (15:15 +0200)
commitb0d67ef5b43aedbb558b9def2da5b4fffeb19966
tree269c0abca492b1216c8e235dbd62ea97647ff855
parent1d9c81833dec46ccb52a1d0db970fefb7c4fa071
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set

[ Upstream commit 944fd1aeacb627fa617f85f8e5a34f7ae8ea4d8e ]

The commit 3c82a21f4320 ("net: allow binding socket in a VRF when
there's an unbound socket") changed the inet socket lookup to avoid
packets in a VRF from matching an unbound socket. This is to ensure the
necessary isolation between the default and other VRFs for routing and
forwarding. VRF-unaware processes running in the default VRF cannot
access another VRF and have to be run with 'ip vrf exec <vrf>'. This is
to be expected with tcp_l3mdev_accept disabled, but could be reallowed
when this sysctl option is enabled. So instead of directly checking dif
and sdif in inet[6]_match, here call inet_sk_bound_dev_eq(). This
allows a match on unbound socket for non-zero sdif i.e. for packets in
a VRF, if tcp_l3mdev_accept is enabled.

Fixes: 3c82a21f4320 ("net: allow binding socket in a VRF when there's an unbound socket")
Signed-off-by: Mike Manning <mvrmanning@gmail.com>
Link: https://lore.kernel.org/netdev/a54c149aed38fded2d3b5fdb1a6c89e36a083b74.camel@lasnet.de/
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
include/net/inet6_hashtables.h
include/net/inet_hashtables.h
include/net/inet_sock.h