Received: by 2002:ac0:950c:0:0:0:0:0 with SMTP id f12csp2273496imc; Tue, 12 Mar 2019 10:21:01 -0700 (PDT) X-Google-Smtp-Source: APXvYqzYgxuUsfCKOZG7DmGycs8Cj8HJwoq3VHNTb/bithm5ek8z5BtPvhyiZ/KGGOXStYFInVK5 X-Received: by 2002:a17:902:8c8a:: with SMTP id t10mr4146633plo.160.1552411261140; Tue, 12 Mar 2019 10:21:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1552411261; cv=none; d=google.com; s=arc-20160816; b=WQIPU2vPNFaXoCdCv3UCqnlRJ8dje/fzM8Nfk4JePkIkHETNrZeSvz0CXWO9BMphQQ jJU+oTIJZQO1jezCIugCuTruUQYEAobPAao/cP990bQXBrPqM6N7UuoW2nKg4W09MLtu IVWlvVeL2vsA9kysi3hmduD7pHQC44LxSsx8H02ZJwVfl8x8kXm7FO7yEEFQaHaQD/Qz TK27VBSBikOMIid1/bNMTCOM+56aWrP71w0UCzenp+7p9HaO6C6fMTl/S6oUl7CNHcRI vc4x0u3+MCs1rYjRy4NxcD438v3RCDGh4Du/H6ov66aKHL72LbG5k7vR0PI2Pt8OTKCB 9ilg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Ri1jcvlH6ncxPfd9ed3xKX2wm4iMo1bn2Csa1U+bhkU=; b=EyeAj2cwMffUPlxs3ZJoeTzgFjescc3DzykxpiLPYLldOEx6bS1e1FtZQvWqP/yO0Q GqBN/SLkch6POHCdSMEexxPRO789vQs5uYUTM6XhxhOJdGVaitkyntnXbCwCQ/iBMfmw pai0DBbedwdiKpZrAiahhtnjK6aOXCF075/GhWUBRUNfmYVhuj4Hkt7Pb7zrSOS/UVD9 Ch4koc2QXqP4lxsR6E42ZPWama96O2M3BgoWMMiBmzYECf2BbJIUeB8hXWlkPKOfr3Pf DdotrdsZ7TnlIo222m6P5chU70VC3pSoSzNn2K3YQ8kuyIjbWrIUzeBsFFMm8hm6BzNg qmAw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rJJiIXo8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 16si7959299pga.351.2019.03.12.10.20.45; Tue, 12 Mar 2019 10:21:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rJJiIXo8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730021AbfCLRSQ (ORCPT + 99 others); Tue, 12 Mar 2019 13:18:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:33364 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729627AbfCLRRb (ORCPT ); Tue, 12 Mar 2019 13:17:31 -0400 Received: from localhost (unknown [104.133.8.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4E10321873; Tue, 12 Mar 2019 17:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1552411050; bh=LqGb4ah8NZwREk8vSbGt2awfs4v1VJnV0y7Ib6FY6+g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rJJiIXo8GJWd/XqaGx+YOwzaK0Cf/sYbEaX7NV14QJhUhld4x/5UiBLd3ePqu61d3 EMHB/lxgIVcy3MXlw1H2RhbJheJT2MKy36N8zunmpOTX3CXN1EtGMqcHAEOXYaVZ6w 6cmf+5S8MMlqhBAoxCMrhvxT+tX8UvHGJ8LKOW10= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Su Yanjun , Steffen Klassert , Sasha Levin Subject: [PATCH 4.9 34/96] vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel Date: Tue, 12 Mar 2019 10:09:52 -0700 Message-Id: <20190312171037.090341126@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190312171034.530434962@linuxfoundation.org> References: <20190312171034.530434962@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ] Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it. We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error. This patch adds compatible support for the ipip process in ipcomp virtual tunnel. Signed-off-by: Su Yanjun Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c index cbff0d6ff1ac..270e79f4d40e 100644 --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c @@ -74,6 +74,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi, return 0; } +static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi, + int encap_type) +{ + struct ip_tunnel *tunnel; + const struct iphdr *iph = ip_hdr(skb); + struct net *net = dev_net(skb->dev); + struct ip_tunnel_net *itn = net_generic(net, vti_net_id); + + tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY, + iph->saddr, iph->daddr, 0); + if (tunnel) { + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto drop; + + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + + return xfrm_input(skb, nexthdr, spi, encap_type); + } + + return -EINVAL; +drop: + kfree_skb(skb); + return 0; +} + static int vti_rcv(struct sk_buff *skb) { XFRM_SPI_SKB_CB(skb)->family = AF_INET; @@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb) return vti_input(skb, ip_hdr(skb)->protocol, 0, 0); } +static int vti_rcv_ipip(struct sk_buff *skb) +{ + XFRM_SPI_SKB_CB(skb)->family = AF_INET; + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); + + return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0); +} + static int vti_rcv_cb(struct sk_buff *skb, int err) { unsigned short family; @@ -439,6 +474,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler __read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority = 0, +}; + static int __net_init vti_init_net(struct net *net) { int err; @@ -622,6 +663,13 @@ static int __init vti_init(void) if (err < 0) goto xfrm_proto_comp_failed; + msg = "ipip tunnel"; + err = xfrm4_tunnel_register(&ipip_handler, AF_INET); + if (err < 0) { + pr_info("%s: cant't register tunnel\n",__func__); + goto xfrm_tunnel_failed; + } + msg = "netlink interface"; err = rtnl_link_register(&vti_link_ops); if (err < 0) @@ -631,6 +679,8 @@ static int __init vti_init(void) rtnl_link_failed: xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); +xfrm_tunnel_failed: + xfrm4_tunnel_deregister(&ipip_handler, AF_INET); xfrm_proto_comp_failed: xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); xfrm_proto_ah_failed: -- 2.19.1