From: guodeqing <geffrey.guo@huawei.com>
To: <davem@davemloft.net>
Cc: <kuba@kernel.org>, <maheshb@google.com>, <edumazet@google.com>,
<netdev@vger.kernel.org>, <geffrey.guo@huawei.com>
Subject: [PATCH,v2] ipvlan: add the check of ip header checksum
Date: Wed, 22 Jul 2020 17:18:19 +0800 [thread overview]
Message-ID: <1595409499-25008-1-git-send-email-geffrey.guo@huawei.com> (raw)
The ip header checksum can be error in the following steps.
$ ip netns add ns1
$ ip link add gw link eth0 type ipvlan
$ ip addr add 168.16.0.1/24 dev gw
$ ip link set dev gw up
$ ip link add ip1 link eth0 type ipvlan
$ ip link set ip1 netns ns1
$ ip netns exec ns1 ip link set ip1 up
$ ip netns exec ns1 ip addr add 168.16.0.2/24 dev ip1
$ ip netns exec ns1 tc qdisc add dev ip1 root netem corrupt 50%
$ ip netns exec ns1 ping 168.16.0.1
This is because the netem will modify the packet randomly. the
corrupted packets should be dropped derectly, otherwise it may
cause a problem.
Here I add the check of ip header checksum and drop the illegal
packets in l3/l3s mode.
Signed-off-by: guodeqing <geffrey.guo@huawei.com>
---
drivers/net/ipvlan/ipvlan_core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 8801d09..ccf3193 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -160,6 +160,10 @@ void *ipvlan_get_L3_hdr(struct ipvl_port *port, struct sk_buff *skb, int *type)
pktlen = ntohs(ip4h->tot_len);
if (ip4h->ihl < 5 || ip4h->version != 4)
return NULL;
+
+ if (unlikely(ip_fast_csum((u8 *)ip4h, ip4h->ihl)))
+ return NULL;
+
if (skb->len < pktlen || pktlen < (ip4h->ihl * 4))
return NULL;
@@ -569,8 +573,10 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
int addr_type;
lyr3h = ipvlan_get_L3_hdr(ipvlan->port, skb, &addr_type);
- if (!lyr3h)
- goto out;
+ if (!lyr3h) {
+ kfree_skb(skb);
+ return NET_XMIT_DROP;
+ }
if (!ipvlan_is_vepa(ipvlan->port)) {
addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
@@ -582,7 +588,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
return ipvlan_rcv_frame(addr, &skb, true);
}
}
-out:
+
ipvlan_skb_crossing_ns(skb, ipvlan->phy_dev);
return ipvlan_process_outbound(skb);
}
--
2.7.4
next reply other threads:[~2020-07-22 9:23 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-22 9:18 guodeqing [this message]
2020-07-22 16:29 ` [PATCH,v2] ipvlan: add the check of ip header checksum Eric Dumazet
2020-07-23 2:02 ` 答复: " Guodeqing (A)
2020-07-22 20:04 ` David Miller
2020-07-23 1:59 ` 答复: " Guodeqing (A)
2020-07-23 2:15 ` Eric Dumazet
2020-07-24 3:35 ` 答复: " Guodeqing (A)
2020-07-24 5:13 ` Eric Dumazet
2020-07-24 8:39 ` 答复: " Guodeqing (A)
2020-07-24 23:44 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1595409499-25008-1-git-send-email-geffrey.guo@huawei.com \
--to=geffrey.guo@huawei.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=maheshb@google.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).