Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

sit: Fix ipip6_tunnel_lookup device matching criteria

As of 4fddbf5d78 ("sit: strictly restrict incoming traffic to tunnel link device"),
when looking up a tunnel, tunnel's underlying interface (t->parms.link)
is verified to match incoming traffic's ingress device.

However the comparison was incorrectly based on skb->dev->iflink.

Instead, dev->ifindex should be used, which correctly represents the
interface from which the IP stack hands the ipip6 packets.

This allows setting up sit tunnels bound to vlan interfaces (otherwise
incoming ipip6 traffic on the vlan interface was dropped due to
ipip6_tunnel_lookup match failure).

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Shmulik Ladkani and committed by
David S. Miller
bc8fc7b8 3b3e0ea8

+3 -3
+3 -3
net/ipv6/sit.c
··· 101 101 for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) { 102 102 if (local == t->parms.iph.saddr && 103 103 remote == t->parms.iph.daddr && 104 - (!dev || !t->parms.link || dev->iflink == t->parms.link) && 104 + (!dev || !t->parms.link || dev->ifindex == t->parms.link) && 105 105 (t->dev->flags & IFF_UP)) 106 106 return t; 107 107 } 108 108 for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) { 109 109 if (remote == t->parms.iph.daddr && 110 - (!dev || !t->parms.link || dev->iflink == t->parms.link) && 110 + (!dev || !t->parms.link || dev->ifindex == t->parms.link) && 111 111 (t->dev->flags & IFF_UP)) 112 112 return t; 113 113 } 114 114 for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) { 115 115 if (local == t->parms.iph.saddr && 116 - (!dev || !t->parms.link || dev->iflink == t->parms.link) && 116 + (!dev || !t->parms.link || dev->ifindex == t->parms.link) && 117 117 (t->dev->flags & IFF_UP)) 118 118 return t; 119 119 }