* [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE
@ 2021-02-03 23:24 Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 1/5] icmp: " Andreas Roeseler
` (4 more replies)
0 siblings, 5 replies; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
The popular utility ping has several severe limitations such as the
inability to query specific interfaces on a node and requiring
bidirectional connectivity between the probing and probed interfaces.
RFC 8335 attempts to solve these limitations by creating the new utility
PROBE which is a specialized ICMP message that makes use of the ICMP
Extention Structure outlined in RFC 4884.
This patchset adds definitions for the ICMP Extended Echo Request and
Reply (PROBE) types for both IPV4 and IPV6, adds a sysctl to enable
response to PROBE messages, expands the list of supported ICMP messages
to accommodate PROBE types, and adds functionality to respond to PROBE
requests.
Changes since v1:
- Add AFI definitions
- Switch to functions such as dev_get_by_name and ip_dev_find to lookup
net devices
Andreas Roeseler (5):
icmp: add support for RFC 8335 PROBE
ICMPV6: add support for RFC 8335 PROBE
net: add sysctl for enabling RFC 8335 PROBE messages
net: add support for sending RFC 8335 PROBE messages
icmp: add response to RFC 8335 PROBE messages
include/net/netns/ipv4.h | 1 +
include/uapi/linux/icmp.h | 24 +++++++++
include/uapi/linux/icmpv6.h | 6 +++
net/ipv4/icmp.c | 98 +++++++++++++++++++++++++++++++++----
net/ipv4/ping.c | 4 +-
net/ipv4/sysctl_net_ipv4.c | 7 +++
6 files changed, 129 insertions(+), 11 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH V2 net-next 1/5] icmp: add support for RFC 8335 PROBE
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
@ 2021-02-03 23:24 ` Andreas Roeseler
2021-02-04 19:42 ` Willem de Bruijn
2021-02-03 23:24 ` [PATCH V2 net-next 2/5] ICMPV6: " Andreas Roeseler
` (3 subsequent siblings)
4 siblings, 1 reply; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
Add definitions for PROBE ICMP types and codes.
Add AFI definitions for IP and IPV6 as specified by IANA
Add a struct to represent the additional header when probing by IP
address (ctype == 3) for use in parsing incoming PROBE messages.
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
---
Changes since v1:
- Add AFI_IP and AFI_IP6 definitions
---
include/uapi/linux/icmp.h | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/include/uapi/linux/icmp.h b/include/uapi/linux/icmp.h
index fb169a50895e..e70bfcc06247 100644
--- a/include/uapi/linux/icmp.h
+++ b/include/uapi/linux/icmp.h
@@ -66,6 +66,23 @@
#define ICMP_EXC_TTL 0 /* TTL count exceeded */
#define ICMP_EXC_FRAGTIME 1 /* Fragment Reass time exceeded */
+/* Codes for EXT_ECHO (PROBE) */
+#define ICMP_EXT_ECHO 42
+#define ICMP_EXT_ECHOREPLY 43
+#define ICMP_EXT_MAL_QUERY 1 /* Malformed Query */
+#define ICMP_EXT_NO_IF 2 /* No such Interface */
+#define ICMP_EXT_NO_TABLE_ENT 3 /* No such Table Entry */
+#define ICMP_EXT_MULT_IFS 4 /* Multiple Interfaces Satisfy Query */
+
+/* constants for EXT_ECHO (PROBE) */
+#define EXT_ECHOREPLY_ACTIVE (1 << 2)/* position of active flag in reply */
+#define EXT_ECHOREPLY_IPV4 (1 << 1)/* position of ipv4 flag in reply */
+#define EXT_ECHOREPLY_IPV6 1 /* position of ipv6 flag in reply */
+#define CTYPE_NAME 1
+#define CTYPE_INDEX 2
+#define CTYPE_ADDR 3
+#define AFI_IP 1 /* Address Family Identifier for IPV4 */
+#define AFI_IP6 2 /* Address Family Identifier for IPV6 */
struct icmphdr {
__u8 type;
@@ -118,4 +135,11 @@ struct icmp_extobj_hdr {
__u8 class_type;
};
+/* RFC 8335: 2.1 Header for C-type 3 payload */
+struct icmp_ext_ctype3_hdr {
+ __u16 afi;
+ __u8 addrlen;
+ __u8 reserved;
+};
+
#endif /* _UAPI_LINUX_ICMP_H */
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH V2 net-next 2/5] ICMPV6: add support for RFC 8335 PROBE
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 1/5] icmp: " Andreas Roeseler
@ 2021-02-03 23:24 ` Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages Andreas Roeseler
` (2 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
Add definitions for the ICMPV6 type of Extended Echo Request and
Extended Echo Reply, as defined in sections 2 and 3 of RFC 8335.
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
---
include/uapi/linux/icmpv6.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/uapi/linux/icmpv6.h b/include/uapi/linux/icmpv6.h
index 0564fd7ccde4..b2a9017ddb2d 100644
--- a/include/uapi/linux/icmpv6.h
+++ b/include/uapi/linux/icmpv6.h
@@ -140,6 +140,12 @@ struct icmp6hdr {
#define ICMPV6_UNK_OPTION 2
#define ICMPV6_HDR_INCOMP 3
+/*
+ * Codes for EXT_ECHO (PROBE)
+ */
+#define ICMPV6_EXT_ECHO_REQUEST 160
+#define ICMPV6_EXT_ECHO_REPLY 161
+
/*
* constants for (set|get)sockopt
*/
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 1/5] icmp: " Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 2/5] ICMPV6: " Andreas Roeseler
@ 2021-02-03 23:24 ` Andreas Roeseler
2021-02-04 19:52 ` Willem de Bruijn
2021-02-03 23:24 ` [PATCH V2 net-next 4/5] net: add support for sending " Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
4 siblings, 1 reply; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
Section 8 of RFC 8335 specifies potential security concerns of
responding to PROBE requests, and states that nodes that support PROBE
functionality MUST be able to enable/disable responses and it is
disabled by default.
Add sysctl to enable responses to PROBE messages.
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
---
Changes since v1:
- Combine patches related to sysctl into one patch
---
include/net/netns/ipv4.h | 1 +
net/ipv4/sysctl_net_ipv4.c | 7 +++++++
2 files changed, 8 insertions(+)
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 70a2a085dd1a..362388ab40c8 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -85,6 +85,7 @@ struct netns_ipv4 {
#endif
int sysctl_icmp_echo_ignore_all;
+ int sysctl_icmp_echo_enable_probe;
int sysctl_icmp_echo_ignore_broadcasts;
int sysctl_icmp_ignore_bogus_error_responses;
int sysctl_icmp_ratelimit;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e5798b3b59d2..06b7241bc01d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -599,6 +599,13 @@ static struct ctl_table ipv4_net_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+ {
+ .procname = "icmp_echo_enable_probe",
+ .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
{
.procname = "icmp_echo_ignore_broadcasts",
.data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH V2 net-next 4/5] net: add support for sending RFC 8335 PROBE messages
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
` (2 preceding siblings ...)
2021-02-03 23:24 ` [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages Andreas Roeseler
@ 2021-02-03 23:24 ` Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
4 siblings, 0 replies; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
Modify the ping_supported function to support PROBE message types. This
allows tools such as the ping command in the iputils package to be
modified to send PROBE requests through the existing framework for
sending ping requests.
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
---
net/ipv4/ping.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 8b943f85fff9..1c9f71a37258 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -453,7 +453,9 @@ EXPORT_SYMBOL_GPL(ping_bind);
static inline int ping_supported(int family, int type, int code)
{
return (family == AF_INET && type == ICMP_ECHO && code == 0) ||
- (family == AF_INET6 && type == ICMPV6_ECHO_REQUEST && code == 0);
+ (family == AF_INET && type == ICMP_EXT_ECHO && code == 0) ||
+ (family == AF_INET6 && type == ICMPV6_ECHO_REQUEST && code == 0) ||
+ (family == AF_INET6 && type == ICMPV6_EXT_ECHO_REQUEST && code == 0);
}
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
` (3 preceding siblings ...)
2021-02-03 23:24 ` [PATCH V2 net-next 4/5] net: add support for sending " Andreas Roeseler
@ 2021-02-03 23:24 ` Andreas Roeseler
2021-02-04 1:18 ` kernel test robot
` (4 more replies)
4 siblings, 5 replies; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-03 23:24 UTC (permalink / raw)
To: davem; +Cc: kuznet, yoshfuji, kuba, netdev
Modify the icmp_rcv function to check for PROBE messages and call
icmp_echo if a PROBE request is detected.
Modify the existing icmp_echo function to respond to both ping and PROBE
requests.
This was tested using a custom modification of the iputils package and
wireshark. It supports IPV4 probing by name, ifindex, and probing by both IPV4 and IPV6
addresses. It currently does not support responding to probes off the proxy node
(See RFC 8335 Section 2).
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
---
Changes since v1:
- Reorder variable declarations to follow coding style
- Switch to functions such as dev_get_by_name and ip_dev_find to lookup
net devices
---
net/ipv4/icmp.c | 98 ++++++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 88 insertions(+), 10 deletions(-)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 396b492c804f..18f9a2a3bf59 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -983,21 +983,85 @@ static bool icmp_redirect(struct sk_buff *skb)
static bool icmp_echo(struct sk_buff *skb)
{
+ struct icmp_bxm icmp_param;
struct net *net;
+ struct net_device *dev;
+ struct icmp_extobj_hdr *extobj_hdr;
+ struct icmp_ext_ctype3_hdr *ctype3_hdr;
+ __u8 status;
net = dev_net(skb_dst(skb)->dev);
- if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
- struct icmp_bxm icmp_param;
+ /* should there be an ICMP stat for ignored echos? */
+ if (net->ipv4.sysctl_icmp_echo_ignore_all)
+ return true;
+
+ icmp_param.data.icmph = *icmp_hdr(skb);
+ icmp_param.skb = skb;
+ icmp_param.offset = 0;
+ icmp_param.data_len = skb->len;
+ icmp_param.head_len = sizeof(struct icmphdr);
- icmp_param.data.icmph = *icmp_hdr(skb);
+ if (icmp_param.data.icmph.type == ICMP_ECHO) {
icmp_param.data.icmph.type = ICMP_ECHOREPLY;
- icmp_param.skb = skb;
- icmp_param.offset = 0;
- icmp_param.data_len = skb->len;
- icmp_param.head_len = sizeof(struct icmphdr);
- icmp_reply(&icmp_param, skb);
+ goto send_reply;
}
- /* should there be an ICMP stat for ignored echos? */
+ if (!net->ipv4.sysctl_icmp_echo_enable_probe)
+ return true;
+ /* We currently do not support probing off the proxy node */
+ if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
+ return true;
+
+ icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
+ icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
+ extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
+ ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
+ status = 0;
+ switch (extobj_hdr->class_type) {
+ case CTYPE_NAME:
+ dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
+ break;
+ case CTYPE_INDEX:
+ dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
+ break;
+ case CTYPE_ADDR:
+ switch (ntohs(ctype3_hdr->afi)) {
+ case AFI_IP:
+ dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
+ break;
+ case AFI_IP6:
+ dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
+ if(dev) dev_hold(dev);
+ break;
+ default:
+ icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
+ goto send_reply;
+ }
+ break;
+ default:
+ icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
+ goto send_reply;
+ }
+ if(!dev) {
+ icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
+ goto send_reply;
+ }
+ /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
+ * are laid out as follows:
+ * +-+-+-+-+-+-+-+-+
+ * |State|Res|A|4|6|
+ * +-+-+-+-+-+-+-+-+
+ */
+ if (dev->flags & IFF_UP)
+ status |= EXT_ECHOREPLY_ACTIVE;
+ if (dev->ip_ptr->ifa_list)
+ status |= EXT_ECHOREPLY_IPV4;
+ if (!list_empty(&dev->ip6_ptr->addr_list))
+ status |= EXT_ECHOREPLY_IPV6;
+ dev_put(dev);
+ icmp_param.data.icmph.un.echo.sequence |= htons(status);
+
+send_reply:
+ icmp_reply(&icmp_param, skb);
return true;
}
@@ -1087,6 +1151,13 @@ int icmp_rcv(struct sk_buff *skb)
icmph = icmp_hdr(skb);
ICMPMSGIN_INC_STATS(net, icmph->type);
+
+ /*
+ * Check for ICMP Extended Echo (PROBE) messages
+ */
+ if (icmph->type == ICMP_EXT_ECHO || icmph->type == ICMPV6_EXT_ECHO_REQUEST)
+ goto probe;
+
/*
* 18 is the highest 'known' ICMP type. Anything else is a mystery
*
@@ -1096,7 +1167,6 @@ int icmp_rcv(struct sk_buff *skb)
if (icmph->type > NR_ICMP_TYPES)
goto error;
-
/*
* Parse the ICMP message
*/
@@ -1123,6 +1193,7 @@ int icmp_rcv(struct sk_buff *skb)
success = icmp_pointers[icmph->type].handler(skb);
+success_check:
if (success) {
consume_skb(skb);
return NET_RX_SUCCESS;
@@ -1136,6 +1207,13 @@ int icmp_rcv(struct sk_buff *skb)
error:
__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
goto drop;
+probe:
+ /*
+ * We can't use icmp_pointers[].handler() because the codes for PROBE
+ * messages are 42 or 160
+ */
+ success = icmp_echo(skb);
+ goto success_check;
}
static bool ip_icmp_error_rfc4884_validate(const struct sk_buff *skb, int off)
--
2.25.1
^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
@ 2021-02-04 1:18 ` kernel test robot
2021-02-04 1:19 ` kernel test robot
` (3 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: kernel test robot @ 2021-02-04 1:18 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 5516 bytes --]
Hi Andreas,
[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on net-next/master]
url: https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6626a0266566c5aea16178c5e6cd7fc4db3f2f56
config: i386-randconfig-s001-20210203 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce:
# apt-get install sparse
# sparse version: v0.6.3-215-g0fb77bb6-dirty
# https://github.com/0day-ci/linux/commit/872bc41b1e24e1adf808034010900ccac61f4c1b
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
git checkout 872bc41b1e24e1adf808034010900ccac61f4c1b
# save the attached .config to linux build tree
make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=i386
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
net/ipv4/icmp.c: In function 'icmp_echo':
net/ipv4/icmp.c:1032:10: error: implicit declaration of function 'ipv6_dev_find'; did you mean 'ip_dev_find'? [-Werror=implicit-function-declaration]
1032 | dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
| ^~~~~~~~~~~~~
| ip_dev_find
>> net/ipv4/icmp.c:1032:8: warning: assignment to 'struct net_device *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
1032 | dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
| ^
cc1: some warnings being treated as errors
vim +1032 net/ipv4/icmp.c
971
972 /*
973 * Handle ICMP_ECHO ("ping") requests.
974 *
975 * RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
976 * requests.
977 * RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
978 * included in the reply.
979 * RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
980 * echo requests, MUST have default=NOT.
981 * See also WRT handling of options once they are done and working.
982 */
983
984 static bool icmp_echo(struct sk_buff *skb)
985 {
986 struct icmp_bxm icmp_param;
987 struct net *net;
988 struct net_device *dev;
989 struct icmp_extobj_hdr *extobj_hdr;
990 struct icmp_ext_ctype3_hdr *ctype3_hdr;
991 __u8 status;
992
993 net = dev_net(skb_dst(skb)->dev);
994 /* should there be an ICMP stat for ignored echos? */
995 if (net->ipv4.sysctl_icmp_echo_ignore_all)
996 return true;
997
998 icmp_param.data.icmph = *icmp_hdr(skb);
999 icmp_param.skb = skb;
1000 icmp_param.offset = 0;
1001 icmp_param.data_len = skb->len;
1002 icmp_param.head_len = sizeof(struct icmphdr);
1003
1004 if (icmp_param.data.icmph.type == ICMP_ECHO) {
1005 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
1006 goto send_reply;
1007 }
1008 if (!net->ipv4.sysctl_icmp_echo_enable_probe)
1009 return true;
1010 /* We currently do not support probing off the proxy node */
1011 if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
1012 return true;
1013
1014 icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
1015 icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
1016 extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
1017 ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
1018 status = 0;
1019 switch (extobj_hdr->class_type) {
1020 case CTYPE_NAME:
1021 dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
1022 break;
1023 case CTYPE_INDEX:
1024 dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
1025 break;
1026 case CTYPE_ADDR:
1027 switch (ntohs(ctype3_hdr->afi)) {
1028 case AFI_IP:
1029 dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
1030 break;
1031 case AFI_IP6:
> 1032 dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
1033 if(dev) dev_hold(dev);
1034 break;
1035 default:
1036 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
1037 goto send_reply;
1038 }
1039 break;
1040 default:
1041 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
1042 goto send_reply;
1043 }
1044 if(!dev) {
1045 icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
1046 goto send_reply;
1047 }
1048 /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
1049 * are laid out as follows:
1050 * +-+-+-+-+-+-+-+-+
1051 * |State|Res|A|4|6|
1052 * +-+-+-+-+-+-+-+-+
1053 */
1054 if (dev->flags & IFF_UP)
1055 status |= EXT_ECHOREPLY_ACTIVE;
1056 if (dev->ip_ptr->ifa_list)
1057 status |= EXT_ECHOREPLY_IPV4;
1058 if (!list_empty(&dev->ip6_ptr->addr_list))
1059 status |= EXT_ECHOREPLY_IPV6;
1060 dev_put(dev);
1061 icmp_param.data.icmph.un.echo.sequence |= htons(status);
1062
1063 send_reply:
1064 icmp_reply(&icmp_param, skb);
1065 return true;
1066 }
1067
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 31906 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
2021-02-04 1:18 ` kernel test robot
@ 2021-02-04 1:19 ` kernel test robot
2021-02-04 7:15 ` Dan Carpenter
` (2 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: kernel test robot @ 2021-02-04 1:19 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 6620 bytes --]
Hi Andreas,
[FYI, it's a private test report for your RFC patch.]
[auto build test ERROR on net-next/master]
url: https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6626a0266566c5aea16178c5e6cd7fc4db3f2f56
config: h8300-randconfig-r022-20210202 (attached as .config)
compiler: h8300-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/872bc41b1e24e1adf808034010900ccac61f4c1b
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
git checkout 872bc41b1e24e1adf808034010900ccac61f4c1b
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=h8300
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All error/warnings (new ones prefixed by >>):
In file included from include/linux/kernel.h:10,
from include/linux/list.h:9,
from include/linux/module.h:12,
from net/ipv4/icmp.c:62:
include/linux/scatterlist.h: In function 'sg_set_buf':
include/asm-generic/page.h:93:50: warning: ordered comparison of pointer with null pointer [-Wextra]
93 | #define virt_addr_valid(kaddr) (((void *)(kaddr) >= (void *)PAGE_OFFSET) && \
| ^~
include/linux/compiler.h:78:42: note: in definition of macro 'unlikely'
78 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/scatterlist.h:137:2: note: in expansion of macro 'BUG_ON'
137 | BUG_ON(!virt_addr_valid(buf));
| ^~~~~~
include/linux/scatterlist.h:137:10: note: in expansion of macro 'virt_addr_valid'
137 | BUG_ON(!virt_addr_valid(buf));
| ^~~~~~~~~~~~~~~
net/ipv4/icmp.c: In function 'icmp_echo':
>> net/ipv4/icmp.c:1032:10: error: implicit declaration of function 'ipv6_dev_find'; did you mean 'ip_dev_find'? [-Werror=implicit-function-declaration]
1032 | dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
| ^~~~~~~~~~~~~
| ip_dev_find
>> net/ipv4/icmp.c:1032:8: warning: assignment to 'struct net_device *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
1032 | dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
| ^
cc1: some warnings being treated as errors
vim +1032 net/ipv4/icmp.c
971
972 /*
973 * Handle ICMP_ECHO ("ping") requests.
974 *
975 * RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
976 * requests.
977 * RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
978 * included in the reply.
979 * RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
980 * echo requests, MUST have default=NOT.
981 * See also WRT handling of options once they are done and working.
982 */
983
984 static bool icmp_echo(struct sk_buff *skb)
985 {
986 struct icmp_bxm icmp_param;
987 struct net *net;
988 struct net_device *dev;
989 struct icmp_extobj_hdr *extobj_hdr;
990 struct icmp_ext_ctype3_hdr *ctype3_hdr;
991 __u8 status;
992
993 net = dev_net(skb_dst(skb)->dev);
994 /* should there be an ICMP stat for ignored echos? */
995 if (net->ipv4.sysctl_icmp_echo_ignore_all)
996 return true;
997
998 icmp_param.data.icmph = *icmp_hdr(skb);
999 icmp_param.skb = skb;
1000 icmp_param.offset = 0;
1001 icmp_param.data_len = skb->len;
1002 icmp_param.head_len = sizeof(struct icmphdr);
1003
1004 if (icmp_param.data.icmph.type == ICMP_ECHO) {
1005 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
1006 goto send_reply;
1007 }
1008 if (!net->ipv4.sysctl_icmp_echo_enable_probe)
1009 return true;
1010 /* We currently do not support probing off the proxy node */
1011 if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
1012 return true;
1013
1014 icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
1015 icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
1016 extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
1017 ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
1018 status = 0;
1019 switch (extobj_hdr->class_type) {
1020 case CTYPE_NAME:
1021 dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
1022 break;
1023 case CTYPE_INDEX:
1024 dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
1025 break;
1026 case CTYPE_ADDR:
1027 switch (ntohs(ctype3_hdr->afi)) {
1028 case AFI_IP:
1029 dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
1030 break;
1031 case AFI_IP6:
> 1032 dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
1033 if(dev) dev_hold(dev);
1034 break;
1035 default:
1036 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
1037 goto send_reply;
1038 }
1039 break;
1040 default:
1041 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
1042 goto send_reply;
1043 }
1044 if(!dev) {
1045 icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
1046 goto send_reply;
1047 }
1048 /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
1049 * are laid out as follows:
1050 * +-+-+-+-+-+-+-+-+
1051 * |State|Res|A|4|6|
1052 * +-+-+-+-+-+-+-+-+
1053 */
1054 if (dev->flags & IFF_UP)
1055 status |= EXT_ECHOREPLY_ACTIVE;
1056 if (dev->ip_ptr->ifa_list)
1057 status |= EXT_ECHOREPLY_IPV4;
1058 if (!list_empty(&dev->ip6_ptr->addr_list))
1059 status |= EXT_ECHOREPLY_IPV6;
1060 dev_put(dev);
1061 icmp_param.data.icmph.un.echo.sequence |= htons(status);
1062
1063 send_reply:
1064 icmp_reply(&icmp_param, skb);
1065 return true;
1066 }
1067
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 22807 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
@ 2021-02-04 7:15 ` Dan Carpenter
2021-02-04 1:19 ` kernel test robot
` (3 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: Dan Carpenter @ 2021-02-04 7:15 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 8372 bytes --]
Hi Andreas,
url: https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6626a0266566c5aea16178c5e6cd7fc4db3f2f56
config: i386-randconfig-m021-20210202 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
net/ipv4/icmp.c:1032 icmp_echo() error: uninitialized symbol 'dev'.
vim +/dev +1032 net/ipv4/icmp.c
e3e3217029a35c Rick Jones 2014-11-17 984 static bool icmp_echo(struct sk_buff *skb)
^1da177e4c3f41 Linus Torvalds 2005-04-16 985 {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 986 struct icmp_bxm icmp_param;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 987 struct net *net;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 988 struct net_device *dev;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 989 struct icmp_extobj_hdr *extobj_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 990 struct icmp_ext_ctype3_hdr *ctype3_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 991 __u8 status;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 992
adf30907d63893 Eric Dumazet 2009-06-02 993 net = dev_net(skb_dst(skb)->dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 994 /* should there be an ICMP stat for ignored echos? */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 995 if (net->ipv4.sysctl_icmp_echo_ignore_all)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 996 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 997
88c7664f13bd1a Arnaldo Carvalho de Melo 2007-03-13 998 icmp_param.data.icmph = *icmp_hdr(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 999 icmp_param.skb = skb;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1000 icmp_param.offset = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1001 icmp_param.data_len = skb->len;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1002 icmp_param.head_len = sizeof(struct icmphdr);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1003
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1004 if (icmp_param.data.icmph.type == ICMP_ECHO) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1005 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1006 goto send_reply;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1007 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1008 if (!net->ipv4.sysctl_icmp_echo_enable_probe)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1009 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1010 /* We currently do not support probing off the proxy node */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1011 if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1012 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1013
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1014 icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1015 icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1016 extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1017 ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1018 status = 0;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1019 switch (extobj_hdr->class_type) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1020 case CTYPE_NAME:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1021 dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1022 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1023 case CTYPE_INDEX:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1024 dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1025 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1026 case CTYPE_ADDR:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1027 switch (ntohs(ctype3_hdr->afi)) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1028 case AFI_IP:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1029 dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1030 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1031 case AFI_IP6:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 @1032 dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
^^^
Possibly uninitialized.
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1033 if(dev) dev_hold(dev);
^^^^^^^^^^^^^^^^^^^^^
You'll probably want to run checkpatch over this patch before sending it
upstream.
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1034 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1035 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1036 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1037 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1038 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1039 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1040 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1041 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1042 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1043 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1044 if(!dev) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1045 icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1046 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1047 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1048 /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1049 * are laid out as follows:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1050 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1051 * |State|Res|A|4|6|
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1052 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1053 */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1054 if (dev->flags & IFF_UP)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1055 status |= EXT_ECHOREPLY_ACTIVE;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1056 if (dev->ip_ptr->ifa_list)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1057 status |= EXT_ECHOREPLY_IPV4;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1058 if (!list_empty(&dev->ip6_ptr->addr_list))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1059 status |= EXT_ECHOREPLY_IPV6;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1060 dev_put(dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1061 icmp_param.data.icmph.un.echo.sequence |= htons(status);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1062
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1063 send_reply:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1064 icmp_reply(&icmp_param, skb);
e3e3217029a35c Rick Jones 2014-11-17 1065 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1066 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 38567 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
@ 2021-02-04 7:15 ` Dan Carpenter
0 siblings, 0 replies; 16+ messages in thread
From: Dan Carpenter @ 2021-02-04 7:15 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 8372 bytes --]
Hi Andreas,
url: https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6626a0266566c5aea16178c5e6cd7fc4db3f2f56
config: i386-randconfig-m021-20210202 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
net/ipv4/icmp.c:1032 icmp_echo() error: uninitialized symbol 'dev'.
vim +/dev +1032 net/ipv4/icmp.c
e3e3217029a35c Rick Jones 2014-11-17 984 static bool icmp_echo(struct sk_buff *skb)
^1da177e4c3f41 Linus Torvalds 2005-04-16 985 {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 986 struct icmp_bxm icmp_param;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 987 struct net *net;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 988 struct net_device *dev;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 989 struct icmp_extobj_hdr *extobj_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 990 struct icmp_ext_ctype3_hdr *ctype3_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 991 __u8 status;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 992
adf30907d63893 Eric Dumazet 2009-06-02 993 net = dev_net(skb_dst(skb)->dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 994 /* should there be an ICMP stat for ignored echos? */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 995 if (net->ipv4.sysctl_icmp_echo_ignore_all)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 996 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 997
88c7664f13bd1a Arnaldo Carvalho de Melo 2007-03-13 998 icmp_param.data.icmph = *icmp_hdr(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 999 icmp_param.skb = skb;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1000 icmp_param.offset = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1001 icmp_param.data_len = skb->len;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1002 icmp_param.head_len = sizeof(struct icmphdr);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1003
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1004 if (icmp_param.data.icmph.type == ICMP_ECHO) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1005 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1006 goto send_reply;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1007 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1008 if (!net->ipv4.sysctl_icmp_echo_enable_probe)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1009 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1010 /* We currently do not support probing off the proxy node */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1011 if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1012 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1013
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1014 icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1015 icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1016 extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1017 ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1018 status = 0;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1019 switch (extobj_hdr->class_type) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1020 case CTYPE_NAME:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1021 dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1022 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1023 case CTYPE_INDEX:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1024 dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1025 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1026 case CTYPE_ADDR:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1027 switch (ntohs(ctype3_hdr->afi)) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1028 case AFI_IP:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1029 dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1030 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1031 case AFI_IP6:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 @1032 dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
^^^
Possibly uninitialized.
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1033 if(dev) dev_hold(dev);
^^^^^^^^^^^^^^^^^^^^^
You'll probably want to run checkpatch over this patch before sending it
upstream.
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1034 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1035 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1036 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1037 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1038 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1039 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1040 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1041 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1042 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1043 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1044 if(!dev) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1045 icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1046 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1047 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1048 /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1049 * are laid out as follows:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1050 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1051 * |State|Res|A|4|6|
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1052 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1053 */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1054 if (dev->flags & IFF_UP)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1055 status |= EXT_ECHOREPLY_ACTIVE;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1056 if (dev->ip_ptr->ifa_list)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1057 status |= EXT_ECHOREPLY_IPV4;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1058 if (!list_empty(&dev->ip6_ptr->addr_list))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1059 status |= EXT_ECHOREPLY_IPV6;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1060 dev_put(dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1061 icmp_param.data.icmph.un.echo.sequence |= htons(status);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1062
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1063 send_reply:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1064 icmp_reply(&icmp_param, skb);
e3e3217029a35c Rick Jones 2014-11-17 1065 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1066 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 38567 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 1/5] icmp: add support for RFC 8335 PROBE
2021-02-03 23:24 ` [PATCH V2 net-next 1/5] icmp: " Andreas Roeseler
@ 2021-02-04 19:42 ` Willem de Bruijn
0 siblings, 0 replies; 16+ messages in thread
From: Willem de Bruijn @ 2021-02-04 19:42 UTC (permalink / raw)
To: Andreas Roeseler
Cc: David Miller, Alexey Kuznetsov, Hideaki YOSHIFUJI,
Jakub Kicinski, Network Development
On Wed, Feb 3, 2021 at 6:25 PM Andreas Roeseler
<andreas.a.roeseler@gmail.com> wrote:
>
> Add definitions for PROBE ICMP types and codes.
>
> Add AFI definitions for IP and IPV6 as specified by IANA
>
> Add a struct to represent the additional header when probing by IP
> address (ctype == 3) for use in parsing incoming PROBE messages.
>
> Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
> ---
> Changes since v1:
> - Add AFI_IP and AFI_IP6 definitions
> ---
> include/uapi/linux/icmp.h | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/include/uapi/linux/icmp.h b/include/uapi/linux/icmp.h
> index fb169a50895e..e70bfcc06247 100644
> --- a/include/uapi/linux/icmp.h
> +++ b/include/uapi/linux/icmp.h
> @@ -66,6 +66,23 @@
> #define ICMP_EXC_TTL 0 /* TTL count exceeded */
> #define ICMP_EXC_FRAGTIME 1 /* Fragment Reass time exceeded */
>
> +/* Codes for EXT_ECHO (PROBE) */
> +#define ICMP_EXT_ECHO 42
> +#define ICMP_EXT_ECHOREPLY 43
> +#define ICMP_EXT_MAL_QUERY 1 /* Malformed Query */
> +#define ICMP_EXT_NO_IF 2 /* No such Interface */
> +#define ICMP_EXT_NO_TABLE_ENT 3 /* No such Table Entry */
> +#define ICMP_EXT_MULT_IFS 4 /* Multiple Interfaces Satisfy Query */
> +
> +/* constants for EXT_ECHO (PROBE) */
> +#define EXT_ECHOREPLY_ACTIVE (1 << 2)/* position of active flag in reply */
> +#define EXT_ECHOREPLY_IPV4 (1 << 1)/* position of ipv4 flag in reply */
> +#define EXT_ECHOREPLY_IPV6 1 /* position of ipv6 flag in reply */
> +#define CTYPE_NAME 1
> +#define CTYPE_INDEX 2
> +#define CTYPE_ADDR 3
Please use a prefix. These definitions are too generic and may clash
with others. Same for the two below. Does all this need to be defined
UAPI?
> +#define AFI_IP 1 /* Address Family Identifier for IPV4 */
> +#define AFI_IP6 2 /* Address Family Identifier for IPV6 */
>
> struct icmphdr {
> __u8 type;
> @@ -118,4 +135,11 @@ struct icmp_extobj_hdr {
> __u8 class_type;
> };
>
> +/* RFC 8335: 2.1 Header for C-type 3 payload */
> +struct icmp_ext_ctype3_hdr {
> + __u16 afi;
> + __u8 addrlen;
> + __u8 reserved;
> +};
> +
> #endif /* _UAPI_LINUX_ICMP_H */
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
` (2 preceding siblings ...)
2021-02-04 7:15 ` Dan Carpenter
@ 2021-02-04 19:52 ` Willem de Bruijn
2021-02-05 5:01 ` Andreas Roeseler
2021-02-04 20:16 ` Jakub Kicinski
4 siblings, 1 reply; 16+ messages in thread
From: Willem de Bruijn @ 2021-02-04 19:52 UTC (permalink / raw)
To: Andreas Roeseler
Cc: David Miller, Alexey Kuznetsov, Hideaki YOSHIFUJI,
Jakub Kicinski, Network Development
On Wed, Feb 3, 2021 at 6:30 PM Andreas Roeseler
<andreas.a.roeseler@gmail.com> wrote:
>
> Modify the icmp_rcv function to check for PROBE messages and call
> icmp_echo if a PROBE request is detected.
>
> Modify the existing icmp_echo function to respond to both ping and PROBE
> requests.
>
> This was tested using a custom modification of the iputils package and
> wireshark. It supports IPV4 probing by name, ifindex, and probing by both IPV4 and IPV6
> addresses. It currently does not support responding to probes off the proxy node
> (See RFC 8335 Section 2).
>
>
> Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
> ---
> Changes since v1:
> - Reorder variable declarations to follow coding style
> - Switch to functions such as dev_get_by_name and ip_dev_find to lookup
> net devices
> ---
> net/ipv4/icmp.c | 98 ++++++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 88 insertions(+), 10 deletions(-)
>
> diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
> index 396b492c804f..18f9a2a3bf59 100644
> --- a/net/ipv4/icmp.c
> +++ b/net/ipv4/icmp.c
> @@ -983,21 +983,85 @@ static bool icmp_redirect(struct sk_buff *skb)
>
> static bool icmp_echo(struct sk_buff *skb)
> {
> + struct icmp_bxm icmp_param;
> struct net *net;
> + struct net_device *dev;
> + struct icmp_extobj_hdr *extobj_hdr;
> + struct icmp_ext_ctype3_hdr *ctype3_hdr;
> + __u8 status;
nit: please maintain reverse christmas tree variable ordering
>
> net = dev_net(skb_dst(skb)->dev);
> - if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
> - struct icmp_bxm icmp_param;
> + /* should there be an ICMP stat for ignored echos? */
> + if (net->ipv4.sysctl_icmp_echo_ignore_all)
> + return true;
> +
> + icmp_param.data.icmph = *icmp_hdr(skb);
> + icmp_param.skb = skb;
> + icmp_param.offset = 0;
> + icmp_param.data_len = skb->len;
> + icmp_param.head_len = sizeof(struct icmphdr);
>
> - icmp_param.data.icmph = *icmp_hdr(skb);
> + if (icmp_param.data.icmph.type == ICMP_ECHO) {
> icmp_param.data.icmph.type = ICMP_ECHOREPLY;
> - icmp_param.skb = skb;
> - icmp_param.offset = 0;
> - icmp_param.data_len = skb->len;
> - icmp_param.head_len = sizeof(struct icmphdr);
> - icmp_reply(&icmp_param, skb);
> + goto send_reply;
> }
> - /* should there be an ICMP stat for ignored echos? */
> + if (!net->ipv4.sysctl_icmp_echo_enable_probe)
> + return true;
> + /* We currently do not support probing off the proxy node */
> + if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
> + return true;
What does this comment mean?
And why does the sequence number need to be even?
> +
> + icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
> + icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
Why this mask?
> + extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
> + ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
It is not safe to trust the contents of unverified packets. We cannot
just cast to a string and call dev_get_by_name. Need to verify packet
length and data format.
Also below code just casts to the expected data type at some offset.
Can that be defined more formally as header structs? Like ctype3_hdr,
but for other headers, as well.
> + status = 0;
> + switch (extobj_hdr->class_type) {
> + case CTYPE_NAME:
> + dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
> + break;
> + case CTYPE_INDEX:
> + dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
> + break;
> + case CTYPE_ADDR:
> + switch (ntohs(ctype3_hdr->afi)) {
> + case AFI_IP:
> + dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
> + break;
> + case AFI_IP6:
> + dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
> + if(dev) dev_hold(dev);
> + break;
> + default:
> + icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
> + goto send_reply;
> + }
> + break;
> + default:
> + icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
> + goto send_reply;
> + }
> + if(!dev) {
> + icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
> + goto send_reply;
> + }
> + /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
> + * are laid out as follows:
> + * +-+-+-+-+-+-+-+-+
> + * |State|Res|A|4|6|
> + * +-+-+-+-+-+-+-+-+
> + */
> + if (dev->flags & IFF_UP)
> + status |= EXT_ECHOREPLY_ACTIVE;
> + if (dev->ip_ptr->ifa_list)
> + status |= EXT_ECHOREPLY_IPV4;
> + if (!list_empty(&dev->ip6_ptr->addr_list))
> + status |= EXT_ECHOREPLY_IPV6;
> + dev_put(dev);
> + icmp_param.data.icmph.un.echo.sequence |= htons(status);
> +
> +send_reply:
> + icmp_reply(&icmp_param, skb);
> return true;
> }
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages Andreas Roeseler
@ 2021-02-04 19:52 ` Willem de Bruijn
0 siblings, 0 replies; 16+ messages in thread
From: Willem de Bruijn @ 2021-02-04 19:52 UTC (permalink / raw)
To: Andreas Roeseler
Cc: David Miller, Alexey Kuznetsov, Hideaki YOSHIFUJI,
Jakub Kicinski, Network Development
On Wed, Feb 3, 2021 at 6:29 PM Andreas Roeseler
<andreas.a.roeseler@gmail.com> wrote:
>
> Section 8 of RFC 8335 specifies potential security concerns of
> responding to PROBE requests, and states that nodes that support PROBE
> functionality MUST be able to enable/disable responses and it is
> disabled by default.
>
> Add sysctl to enable responses to PROBE messages.
>
> Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
> ---
> Changes since v1:
> - Combine patches related to sysctl into one patch
> ---
> include/net/netns/ipv4.h | 1 +
> net/ipv4/sysctl_net_ipv4.c | 7 +++++++
> 2 files changed, 8 insertions(+)
>
> diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> index 70a2a085dd1a..362388ab40c8 100644
> --- a/include/net/netns/ipv4.h
> +++ b/include/net/netns/ipv4.h
> @@ -85,6 +85,7 @@ struct netns_ipv4 {
> #endif
>
> int sysctl_icmp_echo_ignore_all;
> + int sysctl_icmp_echo_enable_probe;
> int sysctl_icmp_echo_ignore_broadcasts;
> int sysctl_icmp_ignore_bogus_error_responses;
> int sysctl_icmp_ratelimit;
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index e5798b3b59d2..06b7241bc01d 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -599,6 +599,13 @@ static struct ctl_table ipv4_net_table[] = {
> .mode = 0644,
> .proc_handler = proc_dointvec
> },
> + {
> + .procname = "icmp_echo_enable_probe",
> + .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec
> + },
proc_dointvec_minmax with zero and one.
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
` (3 preceding siblings ...)
2021-02-04 19:52 ` Willem de Bruijn
@ 2021-02-04 20:16 ` Jakub Kicinski
4 siblings, 0 replies; 16+ messages in thread
From: Jakub Kicinski @ 2021-02-04 20:16 UTC (permalink / raw)
To: Andreas Roeseler; +Cc: davem, kuznet, yoshfuji, netdev
On Wed, 3 Feb 2021 15:24:55 -0800 Andreas Roeseler wrote:
> Modify the icmp_rcv function to check for PROBE messages and call
> icmp_echo if a PROBE request is detected.
>
> Modify the existing icmp_echo function to respond to both ping and PROBE
> requests.
>
> This was tested using a custom modification of the iputils package and
> wireshark. It supports IPV4 probing by name, ifindex, and probing by both IPV4 and IPV6
> addresses. It currently does not support responding to probes off the proxy node
> (See RFC 8335 Section 2).
>
>
> Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
make allmodconfig && make W=1 C=1 says:
../net/ipv4/icmp.c: note: in included file (through ../include/linux/spinlock.h, ../include/linux/mmzone.h, ../include/linux/gfp.h, ../include/linux/umh.h, ../include/linux/kmod.h, ../include/linux/module.h):
../include/linux/bottom_half.h:32:30: warning: context imbalance in 'icmp_reply' - different lock contexts for basic block
../include/linux/bottom_half.h:32:30: warning: context imbalance in '__icmp_send' - different lock contexts for basic block
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1024:45: warning: cast to restricted __be32
../net/ipv4/icmp.c:1027:25: warning: cast to restricted __be16
../net/ipv4/icmp.c:1027:25: warning: cast to restricted __be16
../net/ipv4/icmp.c:1027:25: warning: cast to restricted __be16
../net/ipv4/icmp.c:1027:25: warning: cast to restricted __be16
../net/ipv4/icmp.c:1058:29: warning: incorrect type in argument 1 (different address spaces)
../net/ipv4/icmp.c:1058:29: expected struct list_head const *head
../net/ipv4/icmp.c:1058:29: got struct list_head [noderef] __rcu *
../net/ipv4/icmp.c: note: in included file (through ../include/linux/spinlock.h, ../include/linux/mmzone.h, ../include/linux/gfp.h, ../include/linux/umh.h, ../include/linux/kmod.h, ../include/linux/module.h):
../include/linux/bottom_half.h:32:30: warning: context imbalance in 'icmp_reply' - different lock contexts for basic block
../include/linux/bottom_half.h:32:30: warning: context imbalance in '__icmp_send' - different lock contexts for basic block
../net/ipv4/icmp.c:1056:16: warning: dereference of noderef expression
net/ipv4/icmp.o: In function `icmp_echo':
icmp.c:(.text+0x123a): undefined reference to `ipv6_dev_find'
make[1]: *** [vmlinux] Error 1
make: *** [__sub-make] Error 2
New errors added
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
2021-02-04 19:52 ` Willem de Bruijn
@ 2021-02-05 5:01 ` Andreas Roeseler
0 siblings, 0 replies; 16+ messages in thread
From: Andreas Roeseler @ 2021-02-05 5:01 UTC (permalink / raw)
To: Willem de Bruijn
Cc: David Miller, Alexey Kuznetsov, Hideaki YOSHIFUJI,
Jakub Kicinski, Network Development
On Thu, 2021-02-04 at 14:52 -0500, Willem de Bruijn wrote:
> On Wed, Feb 3, 2021 at 6:30 PM Andreas Roeseler
> <andreas.a.roeseler@gmail.com> wrote:
> >
> > Modify the icmp_rcv function to check for PROBE messages and call
> > icmp_echo if a PROBE request is detected.
> >
> > Modify the existing icmp_echo function to respond to both ping and
> > PROBE
> > requests.
> >
> > This was tested using a custom modification of the iputils package
> > and
> > wireshark. It supports IPV4 probing by name, ifindex, and probing
> > by both IPV4 and IPV6
> > addresses. It currently does not support responding to probes off
> > the proxy node
> > (See RFC 8335 Section 2).
> >
> >
> > Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
> > ---
> > Changes since v1:
> > - Reorder variable declarations to follow coding style
> > - Switch to functions such as dev_get_by_name and ip_dev_find to
> > lookup
> > net devices
> > ---
> > net/ipv4/icmp.c | 98 ++++++++++++++++++++++++++++++++++++++++++++-
> > ----
> > 1 file changed, 88 insertions(+), 10 deletions(-)
> >
> > diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
> > index 396b492c804f..18f9a2a3bf59 100644
> > --- a/net/ipv4/icmp.c
> > +++ b/net/ipv4/icmp.c
> > @@ -983,21 +983,85 @@ static bool icmp_redirect(struct sk_buff
> > *skb)
> >
> > static bool icmp_echo(struct sk_buff *skb)
> > {
> > + struct icmp_bxm icmp_param;
> > struct net *net;
> > + struct net_device *dev;
> > + struct icmp_extobj_hdr *extobj_hdr;
> > + struct icmp_ext_ctype3_hdr *ctype3_hdr;
> > + __u8 status;
>
> nit: please maintain reverse christmas tree variable ordering
>
> >
> > net = dev_net(skb_dst(skb)->dev);
> > - if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
> > - struct icmp_bxm icmp_param;
> > + /* should there be an ICMP stat for ignored echos? */
> > + if (net->ipv4.sysctl_icmp_echo_ignore_all)
> > + return true;
> > +
> > + icmp_param.data.icmph = *icmp_hdr(skb);
> > + icmp_param.skb = skb;
> > + icmp_param.offset = 0;
> > + icmp_param.data_len = skb->len;
> > + icmp_param.head_len = sizeof(struct icmphdr);
> >
> > - icmp_param.data.icmph = *icmp_hdr(skb);
> > + if (icmp_param.data.icmph.type == ICMP_ECHO) {
> > icmp_param.data.icmph.type = ICMP_ECHOREPLY;
> > - icmp_param.skb = skb;
> > - icmp_param.offset = 0;
> > - icmp_param.data_len = skb->len;
> > - icmp_param.head_len = sizeof(struct
> > icmphdr);
> > - icmp_reply(&icmp_param, skb);
> > + goto send_reply;
> > }
> > - /* should there be an ICMP stat for ignored echos? */
> > + if (!net->ipv4.sysctl_icmp_echo_enable_probe)
> > + return true;
> > + /* We currently do not support probing off the proxy node
> > */
> > + if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
> > + return true;
>
> What does this comment mean?
>
> And why does the sequence number need to be even?
RFC 8335 Section 2 specifies that the ICMP Extended Echo Request
messages use a modified sequence number field, as follows.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identifier |Sequence Number| Reserved |L|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The L-bit is set if the probed interface resides on the proxy node. We
only support probing interfaces that lie on the proxy node since it
simplifies the response handler and, if we wanted to know the status of
an interface on another node, we could simply probe that node instead.
This line ensures that the L-bit is set to 1.
I'll clarify the wording of the comment.
>
> > +
> > + icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
> > + icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
>
> Why this mask?
This clears the status fields of the reply message to avoid sending old
data back to the probing host.
>
> > + extobj_hdr = (struct icmp_extobj_hdr *)(skb->data +
> > sizeof(struct icmp_ext_hdr));
> > + ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr +
> > 1);
>
> It is not safe to trust the contents of unverified packets. We cannot
> just cast to a string and call dev_get_by_name. Need to verify packet
> length and data format.
>
Great catch, I will work on adding this into the next version.
> Also below code just casts to the expected data type at some offset.
> Can that be defined more formally as header structs? Like ctype3_hdr,
> but for other headers, as well.
>
Will do.
> > + status = 0;
> > + switch (extobj_hdr->class_type) {
> > + case CTYPE_NAME:
> > + dev = dev_get_by_name(net, (char *)(extobj_hdr +
> > 1));
> > + break;
> > + case CTYPE_INDEX:
> > + dev = dev_get_by_index(net, ntohl(*((uint32_t
> > *)(extobj_hdr + 1))));
> > + break;
> > + case CTYPE_ADDR:
> > + switch (ntohs(ctype3_hdr->afi)) {
> > + case AFI_IP:
> > + dev = ip_dev_find(net, *(__be32
> > *)(ctype3_hdr + 1));
> > + break;
> > + case AFI_IP6:
> > + dev = ipv6_dev_find(net, (struct in6_addr
> > *)(ctype3_hdr + 1), dev);
> > + if(dev) dev_hold(dev);
> > + break;
> > + default:
> > + icmp_param.data.icmph.code =
> > ICMP_EXT_MAL_QUERY;
> > + goto send_reply;
> > + }
> > + break;
> > + default:
> > + icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
> > + goto send_reply;
> > + }
> > + if(!dev) {
> > + icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
> > + goto send_reply;
> > + }
> > + /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply
> > Message
> > + * are laid out as follows:
> > + * +-+-+-+-+-+-+-+-+
> > + * |State|Res|A|4|6|
> > + * +-+-+-+-+-+-+-+-+
> > + */
> > + if (dev->flags & IFF_UP)
> > + status |= EXT_ECHOREPLY_ACTIVE;
> > + if (dev->ip_ptr->ifa_list)
> > + status |= EXT_ECHOREPLY_IPV4;
> > + if (!list_empty(&dev->ip6_ptr->addr_list))
> > + status |= EXT_ECHOREPLY_IPV6;
> > + dev_put(dev);
> > + icmp_param.data.icmph.un.echo.sequence |= htons(status);
> > +
> > +send_reply:
> > + icmp_reply(&icmp_param, skb);
> > return true;
> > }
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH V2 net-next 5/5] icmp: add response to RFC 8335 PROBE messages
@ 2021-02-04 2:10 kernel test robot
0 siblings, 0 replies; 16+ messages in thread
From: kernel test robot @ 2021-02-04 2:10 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 9707 bytes --]
CC: kbuild-all(a)lists.01.org
In-Reply-To: <7af3da33a7aa540f7878cfcbf5076dcf61d201ef.1612393368.git.andreas.a.roeseler@gmail.com>
References: <7af3da33a7aa540f7878cfcbf5076dcf61d201ef.1612393368.git.andreas.a.roeseler@gmail.com>
TO: Andreas Roeseler <andreas.a.roeseler@gmail.com>
Hi Andreas,
[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on net-next/master]
url: https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210204-072756
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6626a0266566c5aea16178c5e6cd7fc4db3f2f56
:::::: branch date: 3 hours ago
:::::: commit date: 3 hours ago
config: i386-randconfig-m021-20210202 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
net/ipv4/icmp.c:1032 icmp_echo() error: uninitialized symbol 'dev'.
vim +/dev +1032 net/ipv4/icmp.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 971
^1da177e4c3f41 Linus Torvalds 2005-04-16 972 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 973 * Handle ICMP_ECHO ("ping") requests.
^1da177e4c3f41 Linus Torvalds 2005-04-16 974 *
^1da177e4c3f41 Linus Torvalds 2005-04-16 975 * RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
^1da177e4c3f41 Linus Torvalds 2005-04-16 976 * requests.
^1da177e4c3f41 Linus Torvalds 2005-04-16 977 * RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
^1da177e4c3f41 Linus Torvalds 2005-04-16 978 * included in the reply.
^1da177e4c3f41 Linus Torvalds 2005-04-16 979 * RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
^1da177e4c3f41 Linus Torvalds 2005-04-16 980 * echo requests, MUST have default=NOT.
^1da177e4c3f41 Linus Torvalds 2005-04-16 981 * See also WRT handling of options once they are done and working.
^1da177e4c3f41 Linus Torvalds 2005-04-16 982 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 983
e3e3217029a35c Rick Jones 2014-11-17 984 static bool icmp_echo(struct sk_buff *skb)
^1da177e4c3f41 Linus Torvalds 2005-04-16 985 {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 986 struct icmp_bxm icmp_param;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 987 struct net *net;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 988 struct net_device *dev;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 989 struct icmp_extobj_hdr *extobj_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 990 struct icmp_ext_ctype3_hdr *ctype3_hdr;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 991 __u8 status;
b34a95ee6e0557 Pavel Emelyanov 2008-03-26 992
adf30907d63893 Eric Dumazet 2009-06-02 993 net = dev_net(skb_dst(skb)->dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 994 /* should there be an ICMP stat for ignored echos? */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 995 if (net->ipv4.sysctl_icmp_echo_ignore_all)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 996 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 997
88c7664f13bd1a Arnaldo Carvalho de Melo 2007-03-13 998 icmp_param.data.icmph = *icmp_hdr(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 999 icmp_param.skb = skb;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1000 icmp_param.offset = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1001 icmp_param.data_len = skb->len;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1002 icmp_param.head_len = sizeof(struct icmphdr);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1003
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1004 if (icmp_param.data.icmph.type == ICMP_ECHO) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1005 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1006 goto send_reply;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1007 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1008 if (!net->ipv4.sysctl_icmp_echo_enable_probe)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1009 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1010 /* We currently do not support probing off the proxy node */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1011 if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1012 return true;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1013
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1014 icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1015 icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1016 extobj_hdr = (struct icmp_extobj_hdr *)(skb->data + sizeof(struct icmp_ext_hdr));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1017 ctype3_hdr = (struct icmp_ext_ctype3_hdr *)(extobj_hdr + 1);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1018 status = 0;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1019 switch (extobj_hdr->class_type) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1020 case CTYPE_NAME:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1021 dev = dev_get_by_name(net, (char *)(extobj_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1022 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1023 case CTYPE_INDEX:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1024 dev = dev_get_by_index(net, ntohl(*((uint32_t *)(extobj_hdr + 1))));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1025 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1026 case CTYPE_ADDR:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1027 switch (ntohs(ctype3_hdr->afi)) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1028 case AFI_IP:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1029 dev = ip_dev_find(net, *(__be32 *)(ctype3_hdr + 1));
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1030 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1031 case AFI_IP6:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 @1032 dev = ipv6_dev_find(net, (struct in6_addr *)(ctype3_hdr + 1), dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1033 if(dev) dev_hold(dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1034 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1035 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1036 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1037 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1038 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1039 break;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1040 default:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1041 icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1042 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1043 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1044 if(!dev) {
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1045 icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1046 goto send_reply;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1047 }
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1048 /* RFC 8335: 3 the last 8 bits of the Extended Echo Reply Message
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1049 * are laid out as follows:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1050 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1051 * |State|Res|A|4|6|
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1052 * +-+-+-+-+-+-+-+-+
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1053 */
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1054 if (dev->flags & IFF_UP)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1055 status |= EXT_ECHOREPLY_ACTIVE;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1056 if (dev->ip_ptr->ifa_list)
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1057 status |= EXT_ECHOREPLY_IPV4;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1058 if (!list_empty(&dev->ip6_ptr->addr_list))
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1059 status |= EXT_ECHOREPLY_IPV6;
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1060 dev_put(dev);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1061 icmp_param.data.icmph.un.echo.sequence |= htons(status);
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1062
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1063 send_reply:
872bc41b1e24e1 Andreas Roeseler 2021-02-03 1064 icmp_reply(&icmp_param, skb);
e3e3217029a35c Rick Jones 2014-11-17 1065 return true;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1066 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 1067
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 38567 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2021-02-05 5:02 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-03 23:24 [PATCH V2 net-next 0/5] add support for RFC 8335 PROBE Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 1/5] icmp: " Andreas Roeseler
2021-02-04 19:42 ` Willem de Bruijn
2021-02-03 23:24 ` [PATCH V2 net-next 2/5] ICMPV6: " Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 3/5] net: add sysctl for enabling RFC 8335 PROBE messages Andreas Roeseler
2021-02-04 19:52 ` Willem de Bruijn
2021-02-03 23:24 ` [PATCH V2 net-next 4/5] net: add support for sending " Andreas Roeseler
2021-02-03 23:24 ` [PATCH V2 net-next 5/5] icmp: add response to " Andreas Roeseler
2021-02-04 1:18 ` kernel test robot
2021-02-04 1:19 ` kernel test robot
2021-02-04 7:15 ` Dan Carpenter
2021-02-04 7:15 ` Dan Carpenter
2021-02-04 19:52 ` Willem de Bruijn
2021-02-05 5:01 ` Andreas Roeseler
2021-02-04 20:16 ` Jakub Kicinski
2021-02-04 2:10 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.