From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CE3AC43470 for ; Mon, 12 Apr 2021 16:24:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 56E8261288 for ; Mon, 12 Apr 2021 16:24:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243642AbhDLQYH (ORCPT ); Mon, 12 Apr 2021 12:24:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:55042 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243351AbhDLQXa (ORCPT ); Mon, 12 Apr 2021 12:23:30 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6E48B60FD7; Mon, 12 Apr 2021 16:23:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1618244592; bh=CgiJsvtTIlGr2/3Du8E/ao+Rgt3ipSLSiXpBcnrtv50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B0sfQL5YZzWQ8140KA60K57Dicf6CvU2tHyafSTM/UkMBpcOMn6v2+iHE4ZzY7l0/ cgBsEVXIZykRuOrOc9wA7SPt/Vi0SvPWSQlJlj8w/t3Z3nvDQK9IHwEyfi6La37cBI 1Yt42oaISMWuucjOmBMgcYtjxTmVjJpyVKHffZeWNXeyeN1t/6ZNDVlbcTmZtBSkSa eE+41vNxrSkjDn8RAB2EaWrwC0Bt5HT8xlmjlTz0ZKIkGR9T1Q2jS7Xs772AN4F356 S8G49rWLk89wapP7TUne7ZKqt11IEeMUEPaRkOxBVhUBUvohqws9Ry1P+bZnln1orG 7n0JyeHqDktUw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Xin Long , Xiumei Mu , Steffen Klassert , Sasha Levin , netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.11 12/51] xfrm: BEET mode doesn't support fragments for inner packets Date: Mon, 12 Apr 2021 12:22:17 -0400 Message-Id: <20210412162256.313524-12-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210412162256.313524-1-sashal@kernel.org> References: <20210412162256.313524-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xin Long [ Upstream commit 68dc022d04eb0fd60a540e242dcb11ec1bee07e2 ] BEET mode replaces the IP(6) Headers with new IP(6) Headers when sending packets. However, when it's a fragment before the replacement, currently kernel keeps the fragment flag and replace the address field then encaps it with ESP. It would cause in RX side the fragments to get reassembled before decapping with ESP, which is incorrect. In Xiumei's testing, these fragments went over an xfrm interface and got encapped with ESP in the device driver, and the traffic was broken. I don't have a good way to fix it, but only to warn this out in dmesg. Reported-by: Xiumei Mu Signed-off-by: Xin Long Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_output.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index a7ab19353313..a455356c8be4 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -660,6 +660,12 @@ static int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb) { int err; + if (x->outer_mode.encap == XFRM_MODE_BEET && + ip_is_fragment(ip_hdr(skb))) { + net_warn_ratelimited("BEET mode doesn't support inner IPv4 fragments\n"); + return -EAFNOSUPPORT; + } + err = xfrm4_tunnel_check_size(skb); if (err) return err; @@ -705,8 +711,15 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) static int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb) { #if IS_ENABLED(CONFIG_IPV6) + unsigned int ptr = 0; int err; + if (x->outer_mode.encap == XFRM_MODE_BEET && + ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL, NULL) >= 0) { + net_warn_ratelimited("BEET mode doesn't support inner IPv6 fragments\n"); + return -EAFNOSUPPORT; + } + err = xfrm6_tunnel_check_size(skb); if (err) return err; -- 2.30.2