From: Willem de Bruijn <firstname.lastname@example.org> To: "Jason A. Donenfeld" <Jason@zx2c4.com> Cc: Hans Wippel <email@example.com>, WireGuard mailing list <firstname.lastname@example.org>, Netdev <email@example.com> Subject: Re: wireguard: problem sending via libpcap's packet socket Date: Sun, 28 Jun 2020 16:04:08 -0400 Message-ID: <CA+FuTSdpU_2w9iU+Rtv8pUepOcwqHYaV1jYVfB6_K157E6CSZw@mail.gmail.com> (raw) In-Reply-To: <CAHmME9oCHNSNAVTNtxO2Oz10iqj_D8JPmN8526FbQ8UoO0-iHw@mail.gmail.com> On Sat, Jun 27, 2020 at 1:58 AM Jason A. Donenfeld <Jason@zx2c4.com> wrote: > > Hi again Hans, > > A few remarks: although gre implements header_ops, it looks like > various parts of the networking stack change behavior based on it. I'm > still analyzing that to understand the extent of the effects. > Something like <https://git.zx2c4.com/wireguard-linux/commit/?id=40c24fd379edc1668087111506ed3d0928052fe0> > would work, but I'm not thrilled by it. Further research is needed. > > However, one thing I noticed is that other layer 3 tunnels don't seem > to be a fan of libpcap. For example, try injecting a packet into an > ipip interface. You'll hit exactly the same snag for skb->protocol==0. Not setting skb protocol when sending over packet sockets causes many headaches. Besides packet_parse_headers, virtio_net_hdr_to_skb also tries to infer it. Packet sockets give various options to configure it explicitly: by choosing that protocol in socket(), bind() or, preferably, by passing it as argument to sendmsg. The socket/bind argument also configures the filter to receive packets, so for send-only sockets it is especially useful to choose ETH_P_NONE (0) there. This is not an "incorrect" option. Libpcap does have a pcap_set_protocol function, but it is fairly recent, so few processes will likely be using it. And again it is still not ideal if a socket is opened only for transmit. header_ops looks like the best approach to me, too. The protocol field needs to reflect the protocol of the *outer* packet, of course, but if I read wg_allowedips_lookup_dst correctly, wireguard maintains the same outer protocol as the inner protocol, no sit (6-in-4) and such.
next prev parent reply index Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <firstname.lastname@example.org> 2020-06-26 20:41 ` Jason A. Donenfeld 2020-06-26 20:42 ` Jason A. Donenfeld 2020-06-27 0:22 ` Jason A. Donenfeld 2020-06-27 5:58 ` Jason A. Donenfeld 2020-06-28 20:04 ` Willem de Bruijn [this message] 2020-07-01 3:05 ` Jason A. Donenfeld 2020-07-01 16:28 ` Willem de Bruijn
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CA+FuTSdpU_2w9iU+Rtv8pUepOcwqHYaV1jYVfB6_K157E6CSZw@mail.gmail.com \ --email@example.com \ --cc=Jason@zx2c4.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
WireGuard Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \ email@example.com public-inbox-index wireguard Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard AGPL code for this site: git clone https://public-inbox.org/public-inbox.git