Patchwork [2/2] ipv6: fix packet corruption when Dest/RT2 options are used

login
register
mail settings
Submitter Romain KUNTZ
Date Jan. 5, 2013, 4:19 p.m.
Message ID <C7895CAA-0AF7-4EED-B9E7-9D8E4A21442B@ipflavors.com>
Download mbox | patch
Permalink /patch/209684/
State Changes Requested
Delegated to: David Miller
Headers show

Comments

Romain KUNTZ - Jan. 5, 2013, 4:19 p.m.
Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
has introduced a bug that provokes corrupted packets when Destination
Options or Routing Header Type 2 are used (such as with Mobile IPv6):
rt->rt6i_nfheader_len should be substracted to rt->dst.header_len,
and not to exthdrlen.

This patch reverts to the original and correct behavior. Successfully
tested with and without IPsec activated for MH packets.

Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
---
 net/ipv6/ip6_output.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
Nicolas Dichtel - Jan. 7, 2013, 10:49 a.m.
Le 05/01/2013 17:19, Romain KUNTZ a écrit :
> Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
Add Steffen into CC, he is the author of this patch and the IPsec
maintainer.

> has introduced a bug that provokes corrupted packets when Destination
> Options or Routing Header Type 2 are used (such as with Mobile IPv6):
> rt->rt6i_nfheader_len should be substracted to rt->dst.header_len,
> and not to exthdrlen.
>
> This patch reverts to the original and correct behavior. Successfully
> tested with and without IPsec activated for MH packets.
>
> Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
> ---
>   net/ipv6/ip6_output.c |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 5552d13..0c7c03d 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
>   		if (dst_allfrag(rt->dst.path))
>   			cork->flags |= IPCORK_ALLFRAG;
>   		cork->length = 0;
> -		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
> +		exthdrlen = (opt ? opt->opt_flen : 0);
>   		length += exthdrlen;
>   		transhdrlen += exthdrlen;
> -		dst_exthdrlen = rt->dst.header_len;
> +		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
>   	} else {
>   		rt = (struct rt6_info *)cork->dst;
>   		fl6 = &inet->cork.fl.u.ip6;
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Steffen Klassert - Jan. 7, 2013, 12:41 p.m.
On Mon, Jan 07, 2013 at 11:49:51AM +0100, Nicolas Dichtel wrote:
> Le 05/01/2013 17:19, Romain KUNTZ a écrit :
> >Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
> Add Steffen into CC, he is the author of this patch and the IPsec
> maintainer.
> 
> >has introduced a bug that provokes corrupted packets when Destination
> >Options or Routing Header Type 2 are used (such as with Mobile IPv6):
> >rt->rt6i_nfheader_len should be substracted to rt->dst.header_len,
> >and not to exthdrlen.

I had no Mobile IPv6 test case, so I likely overlooked this.

> >
> >This patch reverts to the original and correct behavior. Successfully
> >tested with and without IPsec activated for MH packets.
> >
> >Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>

Thanks for catching!

Acked-by: Steffen Klassert <steffen.klassert@secunet.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Romain KUNTZ - Jan. 11, 2013, 7:27 a.m.
On Jan 5, 2013, at 17:19 , Romain KUNTZ <r.kuntz@ipflavors.com> wrote:
> Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
> has introduced a bug that provokes corrupted packets when Destination
> Options or Routing Header Type 2 are used (such as with Mobile IPv6):
> rt->rt6i_nfheader_len should be substracted to rt->dst.header_len,
> and not to exthdrlen.
> 
> This patch reverts to the original and correct behavior. Successfully
> tested with and without IPsec activated for MH packets.
> 
> Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
> Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
> ---
> net/ipv6/ip6_output.c |    4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 5552d13..0c7c03d 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
> 		if (dst_allfrag(rt->dst.path))
> 			cork->flags |= IPCORK_ALLFRAG;
> 		cork->length = 0;
> -		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
> +		exthdrlen = (opt ? opt->opt_flen : 0);
> 		length += exthdrlen;
> 		transhdrlen += exthdrlen;
> -		dst_exthdrlen = rt->dst.header_len;
> +		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
> 	} else {
> 		rt = (struct rt6_info *)cork->dst;
> 		fl6 = &inet->cork.fl.u.ip6;
> -- 
> 1.7.2.5

Resending this one adding the 'Acked-by: Steffen Klassert'.

Romain--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Romain KUNTZ - Jan. 14, 2013, 7:21 a.m.
On Jan 11, 2013, at 8:27 , Romain KUNTZ <r.kuntz@ipflavors.com> wrote:
> On Jan 5, 2013, at 17:19 , Romain KUNTZ <r.kuntz@ipflavors.com> wrote:
>> Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
>> has introduced a bug that provokes corrupted packets when Destination
>> Options or Routing Header Type 2 are used (such as with Mobile IPv6):
>> rt->rt6i_nfheader_len should be substracted to rt->dst.header_len,
>> and not to exthdrlen.
>> 
>> This patch reverts to the original and correct behavior. Successfully
>> tested with and without IPsec activated for MH packets.
>> 
>> Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
>> Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
>> ---
>> net/ipv6/ip6_output.c |    4 ++--
>> 1 files changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
>> index 5552d13..0c7c03d 100644
>> --- a/net/ipv6/ip6_output.c
>> +++ b/net/ipv6/ip6_output.c
>> @@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
>> 		if (dst_allfrag(rt->dst.path))
>> 			cork->flags |= IPCORK_ALLFRAG;
>> 		cork->length = 0;
>> -		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
>> +		exthdrlen = (opt ? opt->opt_flen : 0);
>> 		length += exthdrlen;
>> 		transhdrlen += exthdrlen;
>> -		dst_exthdrlen = rt->dst.header_len;
>> +		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
>> 	} else {
>> 		rt = (struct rt6_info *)cork->dst;
>> 		fl6 = &inet->cork.fl.u.ip6;
>> -- 
>> 1.7.2.5
> 
> Resending this one adding the 'Acked-by: Steffen Klassert'.

I noticed in the patchwork that this patch is in state "Changes Requested" (http://patchwork.ozlabs.org/patch/209684/) but did not get any requests for changes. Any issues/comments regarding this patch?

Thank you,
Romain--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5552d13..0c7c03d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1213,10 +1213,10 @@  int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 		if (dst_allfrag(rt->dst.path))
 			cork->flags |= IPCORK_ALLFRAG;
 		cork->length = 0;
-		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
+		exthdrlen = (opt ? opt->opt_flen : 0);
 		length += exthdrlen;
 		transhdrlen += exthdrlen;
-		dst_exthdrlen = rt->dst.header_len;
+		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
 	} else {
 		rt = (struct rt6_info *)cork->dst;
 		fl6 = &inet->cork.fl.u.ip6;