]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
authorMike Manning <mvrmanning@gmail.com>
Mon, 25 Jul 2022 18:14:42 +0000 (19:14 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Aug 2022 12:41:15 +0000 (14:41 +0200)
commit3c4f99c61ffd6c8291a0288547534da7fe4f5ab7
tree6c54d49d01f9ff6af78994b381ebf5912ed93712
parent7345c721a94e8b9356b3903eca0cf48f552b0951
net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set

[ Upstream commit 944fd1aeacb627fa617f85f8e5a34f7ae8ea4d8e ]

The commit 3c82a21f4320 ("net: allow binding socket in a VRF when
there's an unbound socket") changed the inet socket lookup to avoid
packets in a VRF from matching an unbound socket. This is to ensure the
necessary isolation between the default and other VRFs for routing and
forwarding. VRF-unaware processes running in the default VRF cannot
access another VRF and have to be run with 'ip vrf exec <vrf>'. This is
to be expected with tcp_l3mdev_accept disabled, but could be reallowed
when this sysctl option is enabled. So instead of directly checking dif
and sdif in inet[6]_match, here call inet_sk_bound_dev_eq(). This
allows a match on unbound socket for non-zero sdif i.e. for packets in
a VRF, if tcp_l3mdev_accept is enabled.

Fixes: 3c82a21f4320 ("net: allow binding socket in a VRF when there's an unbound socket")
Signed-off-by: Mike Manning <mvrmanning@gmail.com>
Link: https://lore.kernel.org/netdev/a54c149aed38fded2d3b5fdb1a6c89e36a083b74.camel@lasnet.de/
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
include/net/inet6_hashtables.h
include/net/inet_hashtables.h
include/net/inet_sock.h