Re: [PATCH v2] net: Require exact match for TCP socket lookups if dif is l3mdev

2016-10-14 Thread David Ahern
On 10/14/16 6:21 AM, David Ahern wrote: >> So you might need to let the caller pass IP6CB(skb)->flags (or >> TCP_SKB_CB(skb)->header.h6.flags ) instead of skb since >> inet6_exact_dif_match() does not know where to fetch the flags. >> >> Same issue for IPv4. > > I'll update the match functions to

Re: [PATCH v2] net: Require exact match for TCP socket lookups if dif is l3mdev

2016-10-14 Thread David Ahern
On 10/14/16 12:33 AM, Eric Dumazet wrote: > There is a catch here. > TCP moves IP6CB() in a different location. > > Reference : > > 971f10eca186 ("tcp: better TCP_SKB_CB layout to reduce cache line misses") thanks for the reference. > Problem is that the lookup can happen from IP early demux,

Re: [PATCH v2] net: Require exact match for TCP socket lookups if dif is l3mdev

2016-10-13 Thread Eric Dumazet
On Thu, 2016-10-13 at 21:47 -0700, David Ahern wrote: > Currently, socket lookups for l3mdev (vrf) use cases can match a socket > that is bound to a port but not a device (ie., a global socket). If the > sysctl tcp_l3mdev_accept is not set this leads to ack packets going out > based on the main tab

[PATCH v2] net: Require exact match for TCP socket lookups if dif is l3mdev

2016-10-13 Thread David Ahern
Currently, socket lookups for l3mdev (vrf) use cases can match a socket that is bound to a port but not a device (ie., a global socket). If the sysctl tcp_l3mdev_accept is not set this leads to ack packets going out based on the main table even though the packet came in from an L3 domain. The end r