ipv6: Do route updating for redirect in ndisc layer

From: Duan Jiong <duanj.fnst@cn.fujitsu.com>

In rfc2473, we can know that the tunnel ICMP redirect
message should not be reported to the source of the
original packet, so after calling ip6_tnl_err(), the
rel_msg is set to 0 in function ip4ip6_err(), and the
redirect will never be handled.

In order to deal with this, we have to choices:
  1.move the call to ->redirect to ip6_tnl_err
    and afterwards set rel_msg to 0
  2.factor out the calls to ->redirect into the
    ndisc layer

In this patch , i choose the second one, because i found
the ip6_redirect() could be replaced with
ip6_redirect_no_header(), we could always use ip6_redirect()
for route updating in ndisc layer and use the data of the
redirected header option just for finding the socket to be
notified and then notify user in protocols' err_handler.

Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
---
 include/net/ip6_route.h |  3 ---
 net/dccp/ipv6.c         |  7 -------
 net/ipv6/ah6.c          |  4 +---
 net/ipv6/esp6.c         |  4 +---
 net/ipv6/icmp.c         |  2 --
 net/ipv6/ip6_tunnel.c   |  5 -----
 net/ipv6/ipcomp6.c      |  4 +---
 net/ipv6/ndisc.c        |  6 ++----
 net/ipv6/raw.c          |  2 --
 net/ipv6/route.c        | 29 ++---------------------------
 net/ipv6/tcp_ipv6.c     |  8 --------
 net/ipv6/udp.c          |  2 --
 net/sctp/input.c        | 12 ------------
 net/sctp/ipv6.c         |  3 ---
 14 files changed, 7 insertions(+), 84 deletions(-)

On Mon, Sep 09, 2013 at 03:09:56PM +0800, Duan Jiong wrote:
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 5c71501..61fe8e5 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -382,14 +382,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>  
>  	np = inet6_sk(sk);
>  
> -	if (type == NDISC_REDIRECT) {
> -		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
> -
> -		if (dst)
> -			dst->ops->redirect(dst, sk, skb);
> -		goto out;
> -	}
> -

You dropped the "goto out" here in case of an NDISC_REDIRECT, so this sends an
EPROTO further up the socket layer. Was this intended?

Also:

In some _err() functions there is this check, e.g. ah6.c:

    621         if (type != ICMPV6_DEST_UNREACH &&
    622             type != ICMPV6_PKT_TOOBIG &&
    623             type != NDISC_REDIRECT)
    624                 return;

It could actually be adjusted now as we don't handle NDISC_REDIRECTs here any
more. I don't see any side-effects down the code in these functions. We could
also only just match on ICMPV6_PKT_TOOBIG. Can you confirm?

Greetings,

  Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

于 2013年09月11日 06:50, Hannes Frederic Sowa 写道:
> On Mon, Sep 09, 2013 at 03:09:56PM +0800, Duan Jiong wrote:
>> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
>> index 5c71501..61fe8e5 100644
>> --- a/net/ipv6/tcp_ipv6.c
>> +++ b/net/ipv6/tcp_ipv6.c
>> @@ -382,14 +382,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>>  
>>  	np = inet6_sk(sk);
>>  
>> -	if (type == NDISC_REDIRECT) {
>> -		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
>> -
>> -		if (dst)
>> -			dst->ops->redirect(dst, sk, skb);
>> -		goto out;
>> -	}
>> -
> 
> You dropped the "goto out" here in case of an NDISC_REDIRECT, so this sends an
> EPROTO further up the socket layer. Was this intended?
> 

I'm sorry, i didn't notice the variable err was assigned to EPROTO.
I only thought that message should be sent to the socket layer, because
i found that in function sctp_v6_err().

In addition, the rfc 4443 said the Redirect Message is not the ICMPv6 Error
Message, so i think we shouldn't call those err_handler function, in other
words we shouldn't call the icmpv6_notify().

How do you think of this?

> Also:
> 
> In some _err() functions there is this check, e.g. ah6.c:
> 
>     621         if (type != ICMPV6_DEST_UNREACH &&
>     622             type != ICMPV6_PKT_TOOBIG &&
>     623             type != NDISC_REDIRECT)
>     624                 return;
> 
> It could actually be adjusted now as we don't handle NDISC_REDIRECTs here any
> more. I don't see any side-effects down the code in these functions. We could
> also only just match on ICMPV6_PKT_TOOBIG. Can you confirm?
> 

Yes, i agree this. 

Thanks,
  Duan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[added Cc to Daniel and Vlad because of ipv6/sctp/redirect problem]

On Wed, Sep 11, 2013 at 03:04:35PM +0800, Duan Jiong wrote:
> 于 2013年09月11日 06:50, Hannes Frederic Sowa 写道:
> > On Mon, Sep 09, 2013 at 03:09:56PM +0800, Duan Jiong wrote:
> >> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> >> index 5c71501..61fe8e5 100644
> >> --- a/net/ipv6/tcp_ipv6.c
> >> +++ b/net/ipv6/tcp_ipv6.c
> >> @@ -382,14 +382,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
> >>  
> >>  	np = inet6_sk(sk);
> >>  
> >> -	if (type == NDISC_REDIRECT) {
> >> -		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
> >> -
> >> -		if (dst)
> >> -			dst->ops->redirect(dst, sk, skb);
> >> -		goto out;
> >> -	}
> >> -
> > 
> > You dropped the "goto out" here in case of an NDISC_REDIRECT, so this sends an
> > EPROTO further up the socket layer. Was this intended?
> > 
> 
> I'm sorry, i didn't notice the variable err was assigned to EPROTO.
> I only thought that message should be sent to the socket layer, because
> i found that in function sctp_v6_err().
> 
> In addition, the rfc 4443 said the Redirect Message is not the ICMPv6 Error
> Message, so i think we shouldn't call those err_handler function, in other
> words we shouldn't call the icmpv6_notify().
> 
> How do you think of this?

Hm, thats hard.

First of, when the kernel started publishing these errors it had a
contract with user-space we cannot break now. This includes all error
handling functions which call ipv6_icmp_error. So we only have to care
about INET6_PROTO_FINAL protocols, bbecause they mostly operate in socket
space (in this case these are the raw and the udp protocol and currently
sctp). Especially I do think it is important to report the redirects
to raw sockets. The other non-final protocols only need to be notified
for mtu reduction currently. Maybe we could stop notifying non-final
protocols for redirects, but I don't think this will improve things.

Also we cannot know if the router sending the redirect discarded the
original packet or if it forwarded it just notifying us of a better route,
so we don't know if an actual error happend. So I would do the same thing
as IPv4 sockets, set sk_err to zero and queue up the icmp packet on the
socket's error queue (for udp and raw).

Regarding notifying tcp sockets about the redirect seems wrong. It would
generate a poll notification and I do think it could even tear down
the whole connection.  I guess sctp should also stop updating sk_err
on redirects.  But let's Cc Daniel and Vlad about this. My guess is that
sctp could go into some error recovery mode because of this which would
be wrong.

So, for this patch I would leave the logic as is and not change anything
at the error reporting. Maybe Daniel and Vlad could check if we should
suppress redirect information for ipv6 in sctp, too? But this should
go into another patch.  Regarding the EPROTO problem in raw and udp,
let's see if all the problems go away if we update icmpv6_err_convert
to set *err to 0.

Greetings,

  Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On 09/11/2013 07:17 PM, Hannes Frederic Sowa wrote:
> [added Cc to Daniel and Vlad because of ipv6/sctp/redirect problem]
>
> On Wed, Sep 11, 2013 at 03:04:35PM +0800, Duan Jiong wrote:
>> 于 2013年09月11日 06:50, Hannes Frederic Sowa 写道:
>>> On Mon, Sep 09, 2013 at 03:09:56PM +0800, Duan Jiong wrote:
>>>> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
>>>> index 5c71501..61fe8e5 100644
>>>> --- a/net/ipv6/tcp_ipv6.c
>>>> +++ b/net/ipv6/tcp_ipv6.c
>>>> @@ -382,14 +382,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>>>>
>>>>   	np = inet6_sk(sk);
>>>>
>>>> -	if (type == NDISC_REDIRECT) {
>>>> -		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
>>>> -
>>>> -		if (dst)
>>>> -			dst->ops->redirect(dst, sk, skb);
>>>> -		goto out;
>>>> -	}
>>>> -
>>>
>>> You dropped the "goto out" here in case of an NDISC_REDIRECT, so this sends an
>>> EPROTO further up the socket layer. Was this intended?
>>>
>>
>> I'm sorry, i didn't notice the variable err was assigned to EPROTO.
>> I only thought that message should be sent to the socket layer, because
>> i found that in function sctp_v6_err().
>>
>> In addition, the rfc 4443 said the Redirect Message is not the ICMPv6 Error
>> Message, so i think we shouldn't call those err_handler function, in other
>> words we shouldn't call the icmpv6_notify().
>>
>> How do you think of this?
>
> Hm, thats hard.
>
> First of, when the kernel started publishing these errors it had a
> contract with user-space we cannot break now. This includes all error
> handling functions which call ipv6_icmp_error. So we only have to care
> about INET6_PROTO_FINAL protocols, bbecause they mostly operate in socket
> space (in this case these are the raw and the udp protocol and currently
> sctp). Especially I do think it is important to report the redirects
> to raw sockets. The other non-final protocols only need to be notified
> for mtu reduction currently. Maybe we could stop notifying non-final
> protocols for redirects, but I don't think this will improve things.
>
> Also we cannot know if the router sending the redirect discarded the
> original packet or if it forwarded it just notifying us of a better route,
> so we don't know if an actual error happend. So I would do the same thing
> as IPv4 sockets, set sk_err to zero and queue up the icmp packet on the
> socket's error queue (for udp and raw).
>
> Regarding notifying tcp sockets about the redirect seems wrong. It would
> generate a poll notification and I do think it could even tear down
> the whole connection.  I guess sctp should also stop updating sk_err
> on redirects.  But let's Cc Daniel and Vlad about this. My guess is that
> sctp could go into some error recovery mode because of this which would
> be wrong.

You are right.  SCTP shouldn't be setting sk_err on redirects as it
isn't an error condition.  it should be doing exactly what tcp is doing 
and leaving the error handler without touching the socket.

Thanks
-vlad

>
> So, for this patch I would leave the logic as is and not change anything
> at the error reporting. Maybe Daniel and Vlad could check if we should
> suppress redirect information for ipv6 in sctp, too? But this should
> go into another patch.  Regarding the EPROTO problem in raw and udp,
> let's see if all the problems go away if we update icmpv6_err_convert
> to set *err to 0.
>
> Greetings,
>
>    Hannes
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html