[PATCH,v2] ipvlan: add the check of ip header checksum

* [PATCH,v2] ipvlan: add the check of ip header checksum
@ 2020-07-22  9:18 guodeqing
  2020-07-22 16:29 ` Eric Dumazet
  2020-07-22 20:04 ` David Miller
  0 siblings, 2 replies; 10+ messages in thread
From: guodeqing @ 2020-07-22  9:18 UTC (permalink / raw)
  To: davem; +Cc: kuba, maheshb, edumazet, netdev, geffrey.guo

The ip header checksum can be error in the following steps.
$ ip netns add ns1
$ ip link add gw link eth0 type ipvlan
$ ip addr add 168.16.0.1/24 dev gw
$ ip link set dev gw up
$ ip link add ip1 link eth0 type ipvlan
$ ip link set ip1 netns ns1
$ ip netns exec ns1 ip link set ip1 up
$ ip netns exec ns1 ip addr add 168.16.0.2/24 dev ip1
$ ip netns exec ns1 tc qdisc add dev ip1 root netem corrupt 50%
$ ip netns exec ns1 ping 168.16.0.1

This is because the netem will modify the packet randomly. the
corrupted packets should be dropped derectly, otherwise it may
cause a problem.

Here I add the check of ip header checksum and drop the illegal
packets in l3/l3s mode.

Signed-off-by: guodeqing <geffrey.guo@huawei.com>
---
 drivers/net/ipvlan/ipvlan_core.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 8801d09..ccf3193 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -160,6 +160,10 @@ void *ipvlan_get_L3_hdr(struct ipvl_port *port, struct sk_buff *skb, int *type)
 		pktlen = ntohs(ip4h->tot_len);
 		if (ip4h->ihl < 5 || ip4h->version != 4)
 			return NULL;
+
+		if (unlikely(ip_fast_csum((u8 *)ip4h, ip4h->ihl)))
+			return NULL;
+
 		if (skb->len < pktlen || pktlen < (ip4h->ihl * 4))
 			return NULL;
 
@@ -569,8 +573,10 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
 	int addr_type;
 
 	lyr3h = ipvlan_get_L3_hdr(ipvlan->port, skb, &addr_type);
-	if (!lyr3h)
-		goto out;
+	if (!lyr3h) {
+		kfree_skb(skb);
+		return NET_XMIT_DROP;
+	}
 
 	if (!ipvlan_is_vepa(ipvlan->port)) {
 		addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
@@ -582,7 +588,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
 			return ipvlan_rcv_frame(addr, &skb, true);
 		}
 	}
-out:
+
 	ipvlan_skb_crossing_ns(skb, ipvlan->phy_dev);
 	return ipvlan_process_outbound(skb);
 }
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 10+ messages in thread