Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp578140img; Fri, 22 Mar 2019 04:25:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqwN0zusXTCiiJPcES0wXD2o7JgFJ8V0h8Zb7JmnCaE/AGeLSDu+gt569F2Q+afPIwGwfkHa X-Received: by 2002:a17:902:6b49:: with SMTP id g9mr9061445plt.291.1553253934588; Fri, 22 Mar 2019 04:25:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553253934; cv=none; d=google.com; s=arc-20160816; b=bp8rb8dmJ0ZH8KOtBvfaycSPW1VhWSAYONFW7JHJA//TUbqodKt/Z7azNOsU2e9bfl ZaSDGeCX3WEgCMySCyDgMz7fknIdsqq3Mn67AyOHIkcfsVcL5vxl19BMWVm0P4Hz4OpZ cFAMchL9y2LSzDNS15atbuFwVI0nn8+bccDM9PAOdFSBbIRfrqbMtCNJ2TrUF2AJ3tAP c5Ybuf62O/RxIH5UJYZUQGNIoQSf+s3c9e/vGzRHDEqZii4rNgnIqlOTwhVYUfvCVj+j r9CuWorNGe0hmU6UWYnXQNqUmrqBFPiwO7tLACCBLXkho5fIYVFU5hkW81aPz1cwt97Q gJjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=I0V3PqTnAnK0oGM6qaT5g3GudZY48f21EJG/yEiuzSE=; b=QG+Yh/qfkfljNkimNya/gHsfwh8zKEin2xrq3IkSTSmrGdddQJRjd98evkYZSGAOGU NoUW/H2vtv1FImogSQt6WixZxcUwCR3MIgT4e+Qx5dMsI2IAoq4m8M8rMV/xymdnlkZf eNkHoStSSXGG8iXuRVezg1Cq+Xts1gvCFB4KsKod4Q9WsgWN3MPqHuSTuoWVgVyC/ziy Q63Goe8Cpt0qe+gzkfpwkdOACzMbFKaGr260YRSyIkd58YG6/b7zTBku0dV67P5Mxvaj v4grIlViy1q84s2Du8P9ieyZVdln8Vkjs+mHlsFH+l0SHCYy6wjkKBf5ZWh+ea9OG3WJ xNqg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=r4a39b4l; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f73si6476092pff.184.2019.03.22.04.25.16; Fri, 22 Mar 2019 04:25:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=r4a39b4l; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728763AbfCVLWS (ORCPT + 99 others); Fri, 22 Mar 2019 07:22:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:48938 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728750AbfCVLWP (ORCPT ); Fri, 22 Mar 2019 07:22:15 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 73B1421925; Fri, 22 Mar 2019 11:22:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253734; bh=eJoTbw4jydd4/DME+CUaXafVk6kPfNmgrp9JLGgJNI8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r4a39b4lWD7X5L057F58KfDoPmcs02qDXbSyqt/mlyOG/NoatxSNpoBzQodwY56gD ngjMC8f/JY65AvPxE5xLbaQRxmgiDAECyKvXRXhh7SqdUVkeNWkN73pIffozecAZh8 ODj+dPyiNO9Vb3iUQXF51wgJbNes3mYfoRovVwTM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Su Yanjun , Steffen Klassert , Sasha Levin Subject: [PATCH 3.18 055/134] vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel Date: Fri, 22 Mar 2019 12:14:28 +0100 Message-Id: <20190322111213.949687070@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ] Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it. We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error. This patch adds compatible support for the ipip process in ipcomp virtual tunnel. Signed-off-by: Su Yanjun Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c index c35e0aa57e66..e224ca2ea1c0 100644 --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c @@ -75,6 +75,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi, return 0; } +static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi, + int encap_type) +{ + struct ip_tunnel *tunnel; + const struct iphdr *iph = ip_hdr(skb); + struct net *net = dev_net(skb->dev); + struct ip_tunnel_net *itn = net_generic(net, vti_net_id); + + tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY, + iph->saddr, iph->daddr, 0); + if (tunnel) { + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto drop; + + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + + return xfrm_input(skb, nexthdr, spi, encap_type); + } + + return -EINVAL; +drop: + kfree_skb(skb); + return 0; +} + static int vti_rcv(struct sk_buff *skb) { XFRM_SPI_SKB_CB(skb)->family = AF_INET; @@ -83,6 +110,14 @@ static int vti_rcv(struct sk_buff *skb) return vti_input(skb, ip_hdr(skb)->protocol, 0, 0); } +static int vti_rcv_ipip(struct sk_buff *skb) +{ + XFRM_SPI_SKB_CB(skb)->family = AF_INET; + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); + + return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0); +} + static int vti_rcv_cb(struct sk_buff *skb, int err) { unsigned short family; @@ -409,6 +444,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler __read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority = 0, +}; + static int __net_init vti_init_net(struct net *net) { int err; @@ -562,6 +603,13 @@ static int __init vti_init(void) if (err < 0) goto xfrm_proto_comp_failed; + msg = "ipip tunnel"; + err = xfrm4_tunnel_register(&ipip_handler, AF_INET); + if (err < 0) { + pr_info("%s: cant't register tunnel\n",__func__); + goto xfrm_tunnel_failed; + } + msg = "netlink interface"; err = rtnl_link_register(&vti_link_ops); if (err < 0) @@ -571,6 +619,8 @@ static int __init vti_init(void) rtnl_link_failed: xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); +xfrm_tunnel_failed: + xfrm4_tunnel_deregister(&ipip_handler, AF_INET); xfrm_proto_comp_failed: xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); xfrm_proto_ah_failed: -- 2.19.1