2019-11-16 15:15:20

by Andrea Mayer

Subject: [net, 0/2] seg6: fixes to Segment Routing in IPv6

This patchset is divided in 2 patches and it introduces some fixes
to Segment Routing in IPv6, which are:

- in function get_srh() fix the srh pointer after calling
pskb_may_pull();

- fix the skb->transport_header after calling decap_and_validate()
function;

Any comments on the patchset are welcome.

Thanks.

Andrea Mayer (2):
seg6: fix srh pointer in get_srh()
seg6: fix skb transport_header after decap_and_validate()

net/ipv6/seg6_local.c | 11 +++++++++++
1 file changed, 11 insertions(+)

--
2.20.1

2019-11-16 15:15:23

by Andrea Mayer

Subject: [net, 2/2] seg6: fix skb transport_header after decap_and_validate()

in the receive path (more precisely in ip6_rcv_core()) the
skb->transport_header is set to skb->network_header + sizeof(*hdr). As a
consequence, after routing operations, destination input expects to find
skb->transport_header correctly set to the next protocol (or extension
header) that follows the network protocol. However, decap behaviors (DX*,
DT*) remove the outer IPv6 and SRH extension and do not set again the
skb->transport_header pointer correctly. For this reason, the patch sets
the skb->transport_header to the skb->network_header + sizeof(hdr) in each
DX* and DT* behavior.

Signed-off-by: Andrea Mayer <[email protected]>
---
net/ipv6/seg6_local.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 5e3d7004d431..e70567446f28 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -341,6 +341,8 @@ static int input_action_end_dx6(struct sk_buff *skb,
if (!ipv6_addr_any(&slwt->nh6))
nhaddr = &slwt->nh6;

+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
seg6_lookup_nexthop(skb, nhaddr, 0);

return dst_input(skb);
@@ -370,6 +372,8 @@ static int input_action_end_dx4(struct sk_buff *skb,

skb_dst_drop(skb);

+ skb_set_transport_header(skb, sizeof(struct iphdr));
+
err = ip_route_input(skb, nhaddr, iph->saddr, 0, skb->dev);
if (err)
goto drop;
@@ -390,6 +394,8 @@ static int input_action_end_dt6(struct sk_buff *skb,
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
goto drop;

+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
seg6_lookup_nexthop(skb, NULL, slwt->table);

return dst_input(skb);
--
2.20.1

2019-11-16 15:16:14

by Andrea Mayer

Subject: [net, 1/2] seg6: fix srh pointer in get_srh()

pskb_may_pull may change pointers in header. For this reason, it is
mandatory to reload any pointer that points into skb header.

Signed-off-by: Andrea Mayer <[email protected]>
---
net/ipv6/seg6_local.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 9d4f75e0d33a..5e3d7004d431 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -81,6 +81,11 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb)
if (!pskb_may_pull(skb, srhoff + len))
return NULL;

+ /* note that pskb_may_pull may change pointers in header;
+ * for this reason it is necessary to reload them when needed.
+ */
+ srh = (struct ipv6_sr_hdr *)(skb->data + srhoff);
+
if (!seg6_validate_srh(srh, len))
return NULL;

--
2.20.1

2019-11-16 20:30:49

by David Miller

Subject: Re: [net, 0/2] seg6: fixes to Segment Routing in IPv6

From: Andrea Mayer <[email protected]>
Date: Sat, 16 Nov 2019 16:05:51 +0100

> This patchset is divided in 2 patches and it introduces some fixes
> to Segment Routing in IPv6, which are:
>
> - in function get_srh() fix the srh pointer after calling
> pskb_may_pull();
>
> - fix the skb->transport_header after calling decap_and_validate()
> function;
>
> Any comments on the patchset are welcome.

Series applied and queued up for -stable, thanks.