2018-03-04 20:06:43

by Yossi Kuperman

Subject: [PATCH net] xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto

From: Yossi Kuperman <[email protected]>

Artem Savkov reported that commit 5efec5c655dd leads to a packet loss under
IPSec configuration. It appears that his setup consists of a TUN device,
which does not have a MAC header.

Make sure MAC header exists.

Note: TUN device sets a MAC header pointer, although it does not have one.

Fixes: 5efec5c655dd ("xfrm: Fix eth_hdr(skb)->h_proto to reflect inner IP version")
Reported-by: Artem Savkov <[email protected]>
Tested-by: Artem Savkov <[email protected]>
Signed-off-by: Yossi Kuperman <[email protected]>
---
net/ipv4/xfrm4_mode_tunnel.c | 3 ++-
net/ipv6/xfrm6_mode_tunnel.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 63faeee..2a9764b 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)

skb_reset_network_header(skb);
skb_mac_header_rebuild(skb);
- eth_hdr(skb)->h_proto = skb->protocol;
+ if (skb->mac_len)
+ eth_hdr(skb)->h_proto = skb->protocol;

err = 0;

diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index bb935a3..de1b0b8 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)

skb_reset_network_header(skb);
skb_mac_header_rebuild(skb);
- eth_hdr(skb)->h_proto = skb->protocol;
+ if (skb->mac_len)
+ eth_hdr(skb)->h_proto = skb->protocol;

err = 0;

--
2.8.1

2018-03-07 12:58:31

by Steffen Klassert

Subject: Re: [PATCH net] xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto

On Sun, Mar 04, 2018 at 09:03:52PM +0200, [email protected] wrote:
> From: Yossi Kuperman <[email protected]>
>
> Artem Savkov reported that commit 5efec5c655dd leads to a packet loss under
> IPSec configuration. It appears that his setup consists of a TUN device,
> which does not have a MAC header.
>
> Make sure MAC header exists.
>
> Note: TUN device sets a MAC header pointer, although it does not have one.
>
> Fixes: 5efec5c655dd ("xfrm: Fix eth_hdr(skb)->h_proto to reflect inner IP version")
> Reported-by: Artem Savkov <[email protected]>
> Tested-by: Artem Savkov <[email protected]>
> Signed-off-by: Yossi Kuperman <[email protected]>

Applied, thanks Yossi!