* [PATCH ipsec 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
@ 2019-12-31 16:56 Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 2/2] xfrm interface: " Nicolas Dichtel
0 siblings, 2 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2019-12-31 16:56 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev
Before those patches, packets sent to a vti[6]/xfrm interface via
bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
no dst was attached.
net/ipv4/ip_vti.c | 10 ++++++++--
net/ipv6/ip6_vti.c | 11 +++++++++--
net/xfrm/xfrm_interface.c | 21 +++++++++++++++++----
3 files changed, 34 insertions(+), 8 deletions(-)
Regards,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH ipsec 1/2] vti[6]: fix packet tx through bpf_redirect()
2019-12-31 16:56 [PATCH ipsec 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
@ 2019-12-31 16:56 ` Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 2/2] xfrm interface: " Nicolas Dichtel
1 sibling, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2019-12-31 16:56 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a vti[6] interface,
the packets are dropped because no dst is attached.
This could also be reproduced with an AF_PACKET socket, with the following
python script (vti1 is an ip_vti interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('vti1', 0x800, 0, 0))
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/ipv4/ip_vti.c | 11 +++++++++--
net/ipv6/ip6_vti.c | 11 +++++++++--
2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index cfb025606793..341e0689456d 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -187,8 +187,15 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
int mtu;
if (!dst) {
- dev->stats.tx_carrier_errors++;
- goto tx_error_icmp;
+ struct rtable *rt = __ip_route_output_key(dev_net(dev),
+ &fl->u.ip4);
+
+ if (IS_ERR(rt)) {
+ dev->stats.tx_carrier_errors++;
+ goto tx_error_icmp;
+ }
+ dst = &rt->dst;
+ skb_dst_set(skb, dst);
}
dst_hold(dst);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 024db17386d2..089b9d5dc15e 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -449,8 +449,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
int err = -1;
int mtu;
- if (!dst)
- goto tx_err_link_failure;
+ if (!dst) {
+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ dst = NULL;
+ goto tx_err_link_failure;
+ }
+ skb_dst_set(skb, dst);
+ }
dst_hold(dst);
dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH ipsec 2/2] xfrm interface: fix packet tx through bpf_redirect()
2019-12-31 16:56 [PATCH ipsec 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
@ 2019-12-31 16:56 ` Nicolas Dichtel
2020-01-09 8:40 ` Steffen Klassert
1 sibling, 1 reply; 16+ messages in thread
From: Nicolas Dichtel @ 2019-12-31 16:56 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a xfrm interface,
packets are dropped because no dst is attached to skb.
This could also be reproduced with an AF_PACKET socket, with the following
python script (xfrm1 is a xfrm interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
It was also not possible to send an ip packet through an AF_PACKET socket
because a LL header was expected. Let's remove those LL header constraints.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/xfrm/xfrm_interface.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 7ac1542feaf8..55978a1501ec 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -343,6 +343,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct xfrm_if *xi = netdev_priv(dev);
struct net_device_stats *stats = &xi->dev->stats;
+ struct dst_entry *dst = skb_dst(skb);
struct flowi fl;
int ret;
@@ -352,10 +353,26 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
case htons(ETH_P_IPV6):
xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ if (!dst) {
+ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ goto tx_err;
+ }
+ skb_dst_set(skb, dst);
+ }
break;
case htons(ETH_P_IP):
xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ if (!dst) {
+ struct rtable *rt = __ip_route_output_key(dev_net(dev),
+ &fl.u.ip4);
+
+ if (IS_ERR(rt))
+ goto tx_err;
+ skb_dst_set(skb, &rt->dst);
+ }
break;
default:
goto tx_err;
@@ -563,12 +580,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
{
dev->netdev_ops = &xfrmi_netdev_ops;
dev->type = ARPHRD_NONE;
- dev->hard_header_len = ETH_HLEN;
- dev->min_header_len = ETH_HLEN;
dev->mtu = ETH_DATA_LEN;
dev->min_mtu = ETH_MIN_MTU;
- dev->max_mtu = ETH_DATA_LEN;
- dev->addr_len = ETH_ALEN;
+ dev->max_mtu = IP_MAX_MTU;
dev->flags = IFF_NOARP;
dev->needs_free_netdev = true;
dev->priv_destructor = xfrmi_dev_free;
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec 2/2] xfrm interface: fix packet tx through bpf_redirect()
2019-12-31 16:56 ` [PATCH ipsec 2/2] xfrm interface: " Nicolas Dichtel
@ 2020-01-09 8:40 ` Steffen Klassert
2020-01-09 8:59 ` Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
0 siblings, 2 replies; 16+ messages in thread
From: Steffen Klassert @ 2020-01-09 8:40 UTC (permalink / raw)
To: Nicolas Dichtel; +Cc: davem, netdev
On Tue, Dec 31, 2019 at 05:56:54PM +0100, Nicolas Dichtel wrote:
> With an ebpf program that redirects packets through a xfrm interface,
> packets are dropped because no dst is attached to skb.
>
> This could also be reproduced with an AF_PACKET socket, with the following
> python script (xfrm1 is a xfrm interface):
>
> import socket
> send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
> # scapy
> # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
> # raw(p)
> req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
> send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
>
> It was also not possible to send an ip packet through an AF_PACKET socket
> because a LL header was expected. Let's remove those LL header constraints.
>
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> ---
> net/xfrm/xfrm_interface.c | 22 ++++++++++++++++++----
> 1 file changed, 18 insertions(+), 4 deletions(-)
>
> diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
> index 7ac1542feaf8..55978a1501ec 100644
> --- a/net/xfrm/xfrm_interface.c
> +++ b/net/xfrm/xfrm_interface.c
> @@ -343,6 +343,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
> {
> struct xfrm_if *xi = netdev_priv(dev);
> struct net_device_stats *stats = &xi->dev->stats;
> + struct dst_entry *dst = skb_dst(skb);
> struct flowi fl;
> int ret;
>
> @@ -352,10 +353,26 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
> case htons(ETH_P_IPV6):
> xfrm_decode_session(skb, &fl, AF_INET6);
> memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
> + if (!dst) {
> + dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
> + if (dst->error) {
> + dst_release(dst);
> + goto tx_err;
> + }
> + skb_dst_set(skb, dst);
> + }
> break;
> case htons(ETH_P_IP):
> xfrm_decode_session(skb, &fl, AF_INET);
> memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
> + if (!dst) {
> + struct rtable *rt = __ip_route_output_key(dev_net(dev),
> + &fl.u.ip4);
> +
> + if (IS_ERR(rt))
> + goto tx_err;
With this change, the 'if (!dst)' in xfrmi_xmit2() is meaningless
and we don't handle this error as a link failure anymore.
Please make sure that the error path is not changed.
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec 2/2] xfrm interface: fix packet tx through bpf_redirect()
2020-01-09 8:40 ` Steffen Klassert
@ 2020-01-09 8:59 ` Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
1 sibling, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-09 8:59 UTC (permalink / raw)
To: Steffen Klassert; +Cc: davem, netdev
Le 09/01/2020 à 09:40, Steffen Klassert a écrit :
[snip]
>> @@ -352,10 +353,26 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
>> case htons(ETH_P_IPV6):
>> xfrm_decode_session(skb, &fl, AF_INET6);
>> memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
>> + if (!dst) {
>> + dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
>> + if (dst->error) {
>> + dst_release(dst);
>> + goto tx_err;
>> + }
>> + skb_dst_set(skb, dst);
>> + }
>> break;
>> case htons(ETH_P_IP):
>> xfrm_decode_session(skb, &fl, AF_INET);
>> memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
>> + if (!dst) {
>> + struct rtable *rt = __ip_route_output_key(dev_net(dev),
>> + &fl.u.ip4);
>> +
>> + if (IS_ERR(rt))
>> + goto tx_err;
>
> With this change, the 'if (!dst)' in xfrmi_xmit2() is meaningless
Yep, I was hesitant to remove it :)
> and we don't handle this error as a link failure anymore.
Good point, will send a v2.
Thank you,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-09 8:40 ` Steffen Klassert
2020-01-09 8:59 ` Nicolas Dichtel
@ 2020-01-09 13:35 ` Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
` (2 more replies)
1 sibling, 3 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-09 13:35 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev
Before those patches, packets sent to a vti[6]/xfrm interface via
bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
no dst was attached.
v1 -> v2:
- remove useless check against skb_dst() in xfrmi_xmit2()
- keep incrementing tx_carrier_errors in case of route lookup failure
net/ipv4/ip_vti.c | 11 +++++++++--
net/ipv6/ip6_vti.c | 11 +++++++++--
net/xfrm/xfrm_interface.c | 28 +++++++++++++++++++++-------
3 files changed, 39 insertions(+), 11 deletions(-)
Regards,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH ipsec v2 1/2] vti[6]: fix packet tx through bpf_redirect()
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
@ 2020-01-09 13:35 ` Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 2/2] xfrm interface: " Nicolas Dichtel
2020-01-10 17:42 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2 siblings, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-09 13:35 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a vti[6] interface,
the packets are dropped because no dst is attached.
This could also be reproduced with an AF_PACKET socket, with the following
python script (vti1 is an ip_vti interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('vti1', 0x800, 0, 0))
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/ipv4/ip_vti.c | 11 +++++++++--
net/ipv6/ip6_vti.c | 11 +++++++++--
2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e90b600c7a25..085d7aea82e7 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -187,8 +187,15 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
int mtu;
if (!dst) {
- dev->stats.tx_carrier_errors++;
- goto tx_error_icmp;
+ struct rtable *rt = __ip_route_output_key(dev_net(dev),
+ &fl->u.ip4);
+
+ if (IS_ERR(rt)) {
+ dev->stats.tx_carrier_errors++;
+ goto tx_error_icmp;
+ }
+ dst = &rt->dst;
+ skb_dst_set(skb, dst);
}
dst_hold(dst);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 6f08b760c2a7..a6609803e8b1 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -449,8 +449,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
int err = -1;
int mtu;
- if (!dst)
- goto tx_err_link_failure;
+ if (!dst) {
+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ dst = NULL;
+ goto tx_err_link_failure;
+ }
+ skb_dst_set(skb, dst);
+ }
dst_hold(dst);
dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH ipsec v2 2/2] xfrm interface: fix packet tx through bpf_redirect()
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
@ 2020-01-09 13:35 ` Nicolas Dichtel
2020-01-10 17:42 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2 siblings, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-09 13:35 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a xfrm interface,
packets are dropped because no dst is attached to skb.
This could also be reproduced with an AF_PACKET socket, with the following
python script (xfrm1 is a xfrm interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
It was also not possible to send an ip packet through an AF_PACKET socket
because a LL header was expected. Let's remove those LL header constraints.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/xfrm/xfrm_interface.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 7ac1542feaf8..60481acb10d2 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
int err = -1;
int mtu;
- if (!dst)
- goto tx_err_link_failure;
-
dst_hold(dst);
dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
if (IS_ERR(dst)) {
@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct xfrm_if *xi = netdev_priv(dev);
struct net_device_stats *stats = &xi->dev->stats;
+ struct dst_entry *dst = skb_dst(skb);
struct flowi fl;
int ret;
@@ -352,10 +350,29 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
case htons(ETH_P_IPV6):
xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ if (!dst) {
+ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, dst);
+ }
break;
case htons(ETH_P_IP):
xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ if (!dst) {
+ struct rtable *rt = __ip_route_output_key(dev_net(dev),
+ &fl.u.ip4);
+
+ if (IS_ERR(rt)) {
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, &rt->dst);
+ }
break;
default:
goto tx_err;
@@ -563,12 +580,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
{
dev->netdev_ops = &xfrmi_netdev_ops;
dev->type = ARPHRD_NONE;
- dev->hard_header_len = ETH_HLEN;
- dev->min_header_len = ETH_HLEN;
dev->mtu = ETH_DATA_LEN;
dev->min_mtu = ETH_MIN_MTU;
- dev->max_mtu = ETH_DATA_LEN;
- dev->addr_len = ETH_ALEN;
+ dev->max_mtu = IP_MAX_MTU;
dev->flags = IFF_NOARP;
dev->needs_free_netdev = true;
dev->priv_destructor = xfrmi_dev_free;
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 2/2] xfrm interface: " Nicolas Dichtel
@ 2020-01-10 17:42 ` Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 " Nicolas Dichtel
2 siblings, 1 reply; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-10 17:42 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev
Le 09/01/2020 à 14:35, Nicolas Dichtel a écrit :
> Before those patches, packets sent to a vti[6]/xfrm interface via
> bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
> no dst was attached.
Please, drop this version, I will send an update.
Regards,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-10 17:42 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
@ 2020-01-13 8:32 ` Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
` (2 more replies)
0 siblings, 3 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-13 8:32 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev
Before those patches, packets sent to a vti[6]/xfrm interface via
bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
no dst was attached.
v2 -> v3:
- fix flowi info for the route lookup
v1 -> v2:
- remove useless check against skb_dst() in xfrmi_xmit2()
- keep incrementing tx_carrier_errors in case of route lookup failure
net/ipv4/ip_vti.c | 13 +++++++++++--
net/ipv6/ip6_vti.c | 13 +++++++++++--
net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
3 files changed, 47 insertions(+), 11 deletions(-)
Regards,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH ipsec v3 1/2] vti[6]: fix packet tx through bpf_redirect()
2020-01-13 8:32 ` [PATCH ipsec v3 " Nicolas Dichtel
@ 2020-01-13 8:32 ` Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 2/2] xfrm interface: " Nicolas Dichtel
2020-01-15 9:56 ` [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Steffen Klassert
2 siblings, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-13 8:32 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a vti[6] interface,
the packets are dropped because no dst is attached.
This could also be reproduced with an AF_PACKET socket, with the following
python script (vti1 is an ip_vti interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('vti1', 0x800, 0, 0))
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/ipv4/ip_vti.c | 13 +++++++++++--
net/ipv6/ip6_vti.c | 13 +++++++++++--
2 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e90b600c7a25..37cddd18f282 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -187,8 +187,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
int mtu;
if (!dst) {
- dev->stats.tx_carrier_errors++;
- goto tx_error_icmp;
+ struct rtable *rt;
+
+ fl->u.ip4.flowi4_oif = dev->ifindex;
+ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
+ if (IS_ERR(rt)) {
+ dev->stats.tx_carrier_errors++;
+ goto tx_error_icmp;
+ }
+ dst = &rt->dst;
+ skb_dst_set(skb, dst);
}
dst_hold(dst);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 6f08b760c2a7..524006aa0d78 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -449,8 +449,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
int err = -1;
int mtu;
- if (!dst)
- goto tx_err_link_failure;
+ if (!dst) {
+ fl->u.ip6.flowi6_oif = dev->ifindex;
+ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ dst = NULL;
+ goto tx_err_link_failure;
+ }
+ skb_dst_set(skb, dst);
+ }
dst_hold(dst);
dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [PATCH ipsec v3 2/2] xfrm interface: fix packet tx through bpf_redirect()
2020-01-13 8:32 ` [PATCH ipsec v3 " Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
@ 2020-01-13 8:32 ` Nicolas Dichtel
2020-01-15 9:56 ` [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Steffen Klassert
2 siblings, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-13 8:32 UTC (permalink / raw)
To: steffen.klassert, davem; +Cc: netdev, Nicolas Dichtel
With an ebpf program that redirects packets through a xfrm interface,
packets are dropped because no dst is attached to skb.
This could also be reproduced with an AF_PACKET socket, with the following
python script (xfrm1 is a xfrm interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
It was also not possible to send an ip packet through an AF_PACKET socket
because a LL header was expected. Let's remove those LL header constraints.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
1 file changed, 25 insertions(+), 7 deletions(-)
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 7ac1542feaf8..00393179f185 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
int err = -1;
int mtu;
- if (!dst)
- goto tx_err_link_failure;
-
dst_hold(dst);
dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
if (IS_ERR(dst)) {
@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct xfrm_if *xi = netdev_priv(dev);
struct net_device_stats *stats = &xi->dev->stats;
+ struct dst_entry *dst = skb_dst(skb);
struct flowi fl;
int ret;
@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
case htons(ETH_P_IPV6):
xfrm_decode_session(skb, &fl, AF_INET6);
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ if (!dst) {
+ fl.u.ip6.flowi6_oif = dev->ifindex;
+ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, dst);
+ }
break;
case htons(ETH_P_IP):
xfrm_decode_session(skb, &fl, AF_INET);
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ if (!dst) {
+ struct rtable *rt;
+
+ fl.u.ip4.flowi4_oif = dev->ifindex;
+ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
+ if (IS_ERR(rt)) {
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, &rt->dst);
+ }
break;
default:
goto tx_err;
@@ -563,12 +584,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
{
dev->netdev_ops = &xfrmi_netdev_ops;
dev->type = ARPHRD_NONE;
- dev->hard_header_len = ETH_HLEN;
- dev->min_header_len = ETH_HLEN;
dev->mtu = ETH_DATA_LEN;
dev->min_mtu = ETH_MIN_MTU;
- dev->max_mtu = ETH_DATA_LEN;
- dev->addr_len = ETH_ALEN;
+ dev->max_mtu = IP_MAX_MTU;
dev->flags = IFF_NOARP;
dev->needs_free_netdev = true;
dev->priv_destructor = xfrmi_dev_free;
--
2.24.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-13 8:32 ` [PATCH ipsec v3 " Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 2/2] xfrm interface: " Nicolas Dichtel
@ 2020-01-15 9:56 ` Steffen Klassert
2020-01-27 9:28 ` Nicolas Dichtel
2 siblings, 1 reply; 16+ messages in thread
From: Steffen Klassert @ 2020-01-15 9:56 UTC (permalink / raw)
To: Nicolas Dichtel; +Cc: davem, netdev
On Mon, Jan 13, 2020 at 09:32:45AM +0100, Nicolas Dichtel wrote:
> Before those patches, packets sent to a vti[6]/xfrm interface via
> bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
> no dst was attached.
>
> v2 -> v3:
> - fix flowi info for the route lookup
>
> v1 -> v2:
> - remove useless check against skb_dst() in xfrmi_xmit2()
> - keep incrementing tx_carrier_errors in case of route lookup failure
>
> net/ipv4/ip_vti.c | 13 +++++++++++--
> net/ipv6/ip6_vti.c | 13 +++++++++++--
> net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
> 3 files changed, 47 insertions(+), 11 deletions(-)
Applied to the ipsec tree, thanks a lot!
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-15 9:56 ` [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Steffen Klassert
@ 2020-01-27 9:28 ` Nicolas Dichtel
2020-01-27 9:58 ` Steffen Klassert
0 siblings, 1 reply; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-27 9:28 UTC (permalink / raw)
To: Steffen Klassert; +Cc: davem, netdev
Le 15/01/2020 à 10:56, Steffen Klassert a écrit :
> On Mon, Jan 13, 2020 at 09:32:45AM +0100, Nicolas Dichtel wrote:
>> Before those patches, packets sent to a vti[6]/xfrm interface via
>> bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
>> no dst was attached.
>>
>> v2 -> v3:
>> - fix flowi info for the route lookup
>>
>> v1 -> v2:
>> - remove useless check against skb_dst() in xfrmi_xmit2()
>> - keep incrementing tx_carrier_errors in case of route lookup failure
>>
>> net/ipv4/ip_vti.c | 13 +++++++++++--
>> net/ipv6/ip6_vti.c | 13 +++++++++++--
>> net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>> 3 files changed, 47 insertions(+), 11 deletions(-)
>
> Applied to the ipsec tree, thanks a lot!
>
Thanks. Those patches are now in Linus tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
Could you queue them for stable trees?
Thank you,
Nicolas
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-27 9:28 ` Nicolas Dichtel
@ 2020-01-27 9:58 ` Steffen Klassert
2020-01-27 10:20 ` Nicolas Dichtel
0 siblings, 1 reply; 16+ messages in thread
From: Steffen Klassert @ 2020-01-27 9:58 UTC (permalink / raw)
To: Nicolas Dichtel; +Cc: davem, netdev
On Mon, Jan 27, 2020 at 10:28:10AM +0100, Nicolas Dichtel wrote:
> Le 15/01/2020 à 10:56, Steffen Klassert a écrit :
> > On Mon, Jan 13, 2020 at 09:32:45AM +0100, Nicolas Dichtel wrote:
> >> Before those patches, packets sent to a vti[6]/xfrm interface via
> >> bpf_redirect() or via an AF_PACKET socket were dropped, mostly because
> >> no dst was attached.
> >>
> >> v2 -> v3:
> >> - fix flowi info for the route lookup
> >>
> >> v1 -> v2:
> >> - remove useless check against skb_dst() in xfrmi_xmit2()
> >> - keep incrementing tx_carrier_errors in case of route lookup failure
> >>
> >> net/ipv4/ip_vti.c | 13 +++++++++++--
> >> net/ipv6/ip6_vti.c | 13 +++++++++++--
> >> net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
> >> 3 files changed, 47 insertions(+), 11 deletions(-)
> >
> > Applied to the ipsec tree, thanks a lot!
> >
> Thanks. Those patches are now in Linus tree:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Could you queue them for stable trees?
I'll do an ipsec stable submission the next days.
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets
2020-01-27 9:58 ` Steffen Klassert
@ 2020-01-27 10:20 ` Nicolas Dichtel
0 siblings, 0 replies; 16+ messages in thread
From: Nicolas Dichtel @ 2020-01-27 10:20 UTC (permalink / raw)
To: Steffen Klassert; +Cc: davem, netdev
Le 27/01/2020 à 10:58, Steffen Klassert a écrit :
[snip]
> I'll do an ipsec stable submission the next days.
>
Thanks!
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2020-01-27 10:20 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-31 16:56 [PATCH ipsec 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2019-12-31 16:56 ` [PATCH ipsec 2/2] xfrm interface: " Nicolas Dichtel
2020-01-09 8:40 ` Steffen Klassert
2020-01-09 8:59 ` Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2020-01-09 13:35 ` [PATCH ipsec v2 2/2] xfrm interface: " Nicolas Dichtel
2020-01-10 17:42 ` [PATCH ipsec v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 " Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 1/2] vti[6]: fix packet tx through bpf_redirect() Nicolas Dichtel
2020-01-13 8:32 ` [PATCH ipsec v3 2/2] xfrm interface: " Nicolas Dichtel
2020-01-15 9:56 ` [PATCH ipsec v3 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets Steffen Klassert
2020-01-27 9:28 ` Nicolas Dichtel
2020-01-27 9:58 ` Steffen Klassert
2020-01-27 10:20 ` Nicolas Dichtel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.