From patchwork Sun Feb 9 14:31:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 1235440 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=zx2c4.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=zx2c4.com header.i=@zx2c4.com header.a=rsa-sha1 header.s=mail header.b=rMItmok5; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 48Fs1Z2BgCz9sPF for ; Mon, 10 Feb 2020 01:32:01 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727682AbgBIOb6 (ORCPT ); Sun, 9 Feb 2020 09:31:58 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50091 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727514AbgBIOb6 (ORCPT ); Sun, 9 Feb 2020 09:31:58 -0500 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 5708746a; Sun, 9 Feb 2020 14:30:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:mime-version:content-transfer-encoding; s=mail; bh=JJFus9S7NRZEQ1ty6m+23awMJTw=; b=rMItmok5qKFDcXSCJLct G83276y/f1XDr/0c6xZCaxRXY4UEylB08qVqtRzAY3D8rGReizfbDywDxHiWn/MW hJE/UayShC2Ao1OIneiAq0A+SjB6vQfh/zegFemG+SFzmkMAr0imLtTrSvWjrGNm LmYntBRTobemUoydPSr0b6LyEMBl9Vt+UAkRZSY6SyQV23BFIeUgiv7dEFMZDnBF ZDXF48ZVw3rB+mJU+wPUYywBZGuRTQk7QqAIn4Nyogi+sS5tQbZJEUiKPtfxckJ0 bj0OeYTL+y8EkgWcrYuX1UVX1PkIlBLneX6ht2CfzB0+5anrx/NChh5PRVRupaJY mQ== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id be171211 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 9 Feb 2020 14:30:28 +0000 (UTC) From: "Jason A. Donenfeld" To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Florian Westphal Subject: [PATCH net 1/5] icmp: introduce helper for NAT'd source address in ndo context Date: Sun, 9 Feb 2020 15:31:39 +0100 Message-Id: <20200209143143.151632-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org The ICMP routines use the source address for two reasons: 1. Rate-limiting ICMP transmissions based on source address, so that one source address cannot provoke a flood of replies. If the source address is wrong, the rate limiting will be incorrectly applied. 2. Choosing the interface and hence new source address of the generated ICMP packet. If the original packet source address is wrong, ICMP replies will be sent from the wrong source address, resulting in either a misdelivery, infoleak, or just general network admin confusion. Most of the time, the icmp_send and icmpv6_send routines can just reach down into the skb's IP header to determine the saddr. However, if icmp_send or icmpv6_send is being called from a network device driver -- there are a few in the tree -- then it's possible that by the time icmp_send or icmpv6_send looks at the packet, the packet's source address has already been transformed by SNAT or MASQUERADE or some other transformation that CONNTRACK knows about. In this case, the packet's source address is most certainly the *wrong* source address to be used for the purpose of ICMP replies. Rather, the source address we want to use for ICMP replies is the original one, from before the transformation occurred. Fortunately, it's very easy to just ask CONNTRACK if it knows about this packet, and if so, how to fix it up. The saddr is the only field in the header we need to fix up, for the purposes of the subsequent processing in the icmp_send and icmpv6_send functions, so we do the lookup very early on, so that the rest of the ICMP machinery can progress as usual. We don't want to pollute the non-driver path, though, so we introduce this as a helper to be called by places that actually make use of this, as suggested by Florian. Signed-off-by: Jason A. Donenfeld Cc: Florian Westphal --- Dave - this fixes bugs, so net.git seemed fitting, but if you think this is a bit invasive or will require several more series of development, I don't mind working on this in net-next.git instead. include/linux/icmpv6.h | 6 ++++++ include/net/icmp.h | 6 ++++++ net/ipv4/icmp.c | 14 ++++++++++++++ net/ipv6/ip6_icmp.c | 15 +++++++++++++++ 4 files changed, 41 insertions(+) diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h index ef1cbb5f454f..47cea3779eb1 100644 --- a/include/linux/icmpv6.h +++ b/include/linux/icmpv6.h @@ -31,6 +31,12 @@ static inline void icmpv6_send(struct sk_buff *skb, } #endif +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +void icmpv6_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info); +#else +#define icmpv6_ndo_send icmpv6_send +#endif + extern int icmpv6_init(void); extern int icmpv6_err_convert(u8 type, u8 code, int *err); diff --git a/include/net/icmp.h b/include/net/icmp.h index 5d4bfdba9adf..30257506c038 100644 --- a/include/net/icmp.h +++ b/include/net/icmp.h @@ -43,6 +43,12 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt); } +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info); +#else +#define icmp_ndo_send icmp_send +#endif + int icmp_rcv(struct sk_buff *skb); int icmp_err(struct sk_buff *skb, u32 info); int icmp_init(void); diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 18068ed42f25..54b923bca655 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -748,6 +748,20 @@ out:; } EXPORT_SYMBOL(__icmp_send); +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +#include +void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) +{ + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + + ct = nf_ct_get(skb_in, &ctinfo); + if (ct) + ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip; + icmp_send(skb_in, type, code, info); +} +EXPORT_SYMBOL(icmp_ndo_send); +#endif static void icmp_socket_deliver(struct sk_buff *skb, u32 info) { diff --git a/net/ipv6/ip6_icmp.c b/net/ipv6/ip6_icmp.c index 02045494c24c..c79bf2d616cf 100644 --- a/net/ipv6/ip6_icmp.c +++ b/net/ipv6/ip6_icmp.c @@ -45,4 +45,19 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) rcu_read_unlock(); } EXPORT_SYMBOL(icmpv6_send); + +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +#include +void icmpv6_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) +{ + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + + ct = nf_ct_get(skb_in, &ctinfo); + if (ct) + ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6; + icmpv6_send(skb_in, type, code, info); +} +EXPORT_SYMBOL(icmpv6_ndo_send); +#endif #endif From patchwork Sun Feb 9 14:31:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 1235442 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=zx2c4.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=zx2c4.com header.i=@zx2c4.com header.a=rsa-sha1 header.s=mail header.b=OLKv/2b+; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 48Fs1c3vsrz9sPK for ; Mon, 10 Feb 2020 01:32:04 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727732AbgBIOcB (ORCPT ); Sun, 9 Feb 2020 09:32:01 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50091 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727514AbgBIOcA (ORCPT ); Sun, 9 Feb 2020 09:32:00 -0500 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id b67120f7; Sun, 9 Feb 2020 14:30:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=mail; bh=JzV6toZzstw9vzB/ziu+YJh5G mY=; b=OLKv/2b+aVhhwgl47Nx2vGuvO0KNl1ZtiLCEuQPqfOGeRHvppi87cD67/ LGE4PLe+DMH3FF2Me9sdNv7LMLvl05iRoayjtB/gNF9A8OgokoNHHfnkNiR+03Tr 0N3vzUyCDr+khqtMBORltzbG16W5DHuDFcHUGUvdtSM8j62oPObW/2VhqEcPJSUL 29wFd0orhmGaeu/BNXrzitKdhOE6glKMFl+pnmLdU0VvE5miktemr80Arqc0crUs p/9h1+3eiubXqW3/efnilVldVaNYoKyv69ICHkfk/bNx2JZKLJzc8Kqdms+BsibP iAxIsTSNHgyTiRBDy1wI1wFUIFk9g== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 3f9a9807 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 9 Feb 2020 14:30:30 +0000 (UTC) From: "Jason A. Donenfeld" To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Harald Welte Subject: [PATCH net 2/5] gtp: use icmp_ndo_send helper Date: Sun, 9 Feb 2020 15:31:40 +0100 Message-Id: <20200209143143.151632-2-Jason@zx2c4.com> In-Reply-To: <20200209143143.151632-1-Jason@zx2c4.com> References: <20200209143143.151632-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Because gtp is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld Cc: Harald Welte --- drivers/net/gtp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index af07ea760b35..672cd2caf2fb 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -546,8 +546,8 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, mtu < ntohs(iph->tot_len)) { netdev_dbg(dev, "packet too big, fragmentation needed\n"); memset(IPCB(skb), 0, sizeof(*IPCB(skb))); - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, - htonl(mtu)); + icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); goto err_rt; } From patchwork Sun Feb 9 14:31:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 1235441 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=zx2c4.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=zx2c4.com header.i=@zx2c4.com header.a=rsa-sha1 header.s=mail header.b=RH0srbom; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 48Fs1c0RQxz9sPJ for ; Mon, 10 Feb 2020 01:32:04 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727771AbgBIOcB (ORCPT ); Sun, 9 Feb 2020 09:32:01 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50091 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727707AbgBIOcB (ORCPT ); Sun, 9 Feb 2020 09:32:01 -0500 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 390d1be5; Sun, 9 Feb 2020 14:30:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=mail; bh=rf9rKvRL4CbLATzMEqkECuQxf ZA=; b=RH0srbom4kXp+qL16lGxIQB/liuBAd3wa0SfhzkfXOs9AXq6ZQaIqiwTj cS5iGW/kTWTx5Atl5NYJyMqoBMp9agq4paoILC8pKeNEwn5+LW54GgxxfUsPUbyn jiq8xZZSasjRMb+QH14jlj4jRwdKJQBr06/xm8Rwk7/5sWOJF18ac9UTo0Q9bqz9 cjrVk5aklSdp0PCjpKh/X1NsEDLBHAWmHzRIh03scQY7Asm2G+6llwwl1fcmbnWR IYrO1WeMhgm66lefycg+MLjNyKEREyOHX0UIy9MJbNXt661rDPYhJXcer35fd0Xi cwtgTsvzQDknCjziHSdTpzyzrs8hA== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id b547cfa0 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 9 Feb 2020 14:30:32 +0000 (UTC) From: "Jason A. Donenfeld" To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Shannon Nelson Subject: [PATCH net 3/5] sunvnet: use icmp_ndo_send helper Date: Sun, 9 Feb 2020 15:31:41 +0100 Message-Id: <20200209143143.151632-3-Jason@zx2c4.com> In-Reply-To: <20200209143143.151632-1-Jason@zx2c4.com> References: <20200209143143.151632-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Because sunvnet is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld Cc: Shannon Nelson --- drivers/net/ethernet/sun/sunvnet_common.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethernet/sun/sunvnet_common.c index c23ce838ff63..9948c00fe625 100644 --- a/drivers/net/ethernet/sun/sunvnet_common.c +++ b/drivers/net/ethernet/sun/sunvnet_common.c @@ -1363,14 +1363,14 @@ sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev, rt = ip_route_output_key(dev_net(dev), &fl4); if (!IS_ERR(rt)) { skb_dst_set(skb, &rt->dst); - icmp_send(skb, ICMP_DEST_UNREACH, - ICMP_FRAG_NEEDED, - htonl(localmtu)); + icmp_ndo_send(skb, ICMP_DEST_UNREACH, + ICMP_FRAG_NEEDED, + htonl(localmtu)); } } #if IS_ENABLED(CONFIG_IPV6) else if (skb->protocol == htons(ETH_P_IPV6)) - icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, localmtu); + icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, localmtu); #endif goto out_dropped; } From patchwork Sun Feb 9 14:31:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 1235448 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=zx2c4.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=zx2c4.com header.i=@zx2c4.com header.a=rsa-sha1 header.s=mail header.b=u6Xc1NWC; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 48Fs1j6kYSz9sPF for ; Mon, 10 Feb 2020 01:32:09 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727801AbgBIOcF (ORCPT ); Sun, 9 Feb 2020 09:32:05 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50091 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727707AbgBIOcE (ORCPT ); Sun, 9 Feb 2020 09:32:04 -0500 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id cf90af9c; Sun, 9 Feb 2020 14:30:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=mail; bh=l05ky+REA+M+7GRJvz85D2lrR VQ=; b=u6Xc1NWCIsJSF3qV4hMNCm7H7D0NVIxpMjgmaOcfez7t55pOkGNcdOOVJ 5zikRBS7ndYU3ky9U4RCpxgZTfcmrrfvNeqWMGY7SyeKgbxvo/Ji+E2+0jp63rZb lnBBbMNB7bNnWj40MYGFOqAW8MsENuVOazgCUeSfsa5f2oeB+APfBEg4YmKxFSGK JZ3pCA0sLi8tIzqbxaAhFmnduOU1SurnoID6PGSPFo64MnX3KjQeNNgYPKmgLexZ M4BirMtEA3xSduhNSbKINx9uP0+AwHDhakO/mR+w3Zs0nzriDvE/FRQlMcNi/m2l 0LqRv5w5cSiuVUDrDPiBiiFVCnKCQ== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id ac609492 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 9 Feb 2020 14:30:33 +0000 (UTC) From: "Jason A. Donenfeld" To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Cc: "Jason A. Donenfeld" Subject: [PATCH net 4/5] wireguard: use icmp_ndo_send helper Date: Sun, 9 Feb 2020 15:31:42 +0100 Message-Id: <20200209143143.151632-4-Jason@zx2c4.com> In-Reply-To: <20200209143143.151632-1-Jason@zx2c4.com> References: <20200209143143.151632-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Because wireguard is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld --- drivers/net/wireguard/device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c index 16b19824b9ad..43db442b1373 100644 --- a/drivers/net/wireguard/device.c +++ b/drivers/net/wireguard/device.c @@ -203,9 +203,9 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) err: ++dev->stats.tx_errors; if (skb->protocol == htons(ETH_P_IP)) - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); + icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); else if (skb->protocol == htons(ETH_P_IPV6)) - icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0); + icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0); kfree_skb(skb); return ret; } From patchwork Sun Feb 9 14:31:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 1235449 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=zx2c4.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=zx2c4.com header.i=@zx2c4.com header.a=rsa-sha1 header.s=mail header.b=XfSLWJP9; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 48Fs1k2p7vz9sPJ for ; Mon, 10 Feb 2020 01:32:10 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727815AbgBIOcG (ORCPT ); Sun, 9 Feb 2020 09:32:06 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50091 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727784AbgBIOcF (ORCPT ); Sun, 9 Feb 2020 09:32:05 -0500 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 8c84ce3f; Sun, 9 Feb 2020 14:30:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=mail; bh=wfT3X7qXqNUU0/0EQjnwE4gcH QY=; b=XfSLWJP93VNOn4AO6xAeKWmMReuP+xW/cnPOzccBpIcqaXeNLYwjUzGQc mQA6ExsXhuC2a/fbqhjjX9v/A+2xNhBlY+HusFQ1AbFhcKPs/MuU7lP36CP1UAIU kkBdAjDOhqfOWpcyU7uxI/cb8q/cdtumT6rN8eoAYAcHHl+DRTMoqPLRC/Db43nb WK2AZxJPmx1x5p65TXwaKZwVYehkX1d3RA+DfoTieXJhup4D6aVYqN1GBpNeOA/9 a/I1llPajZBwjNfJOVPQX96pJgFMagOr1dsnvc0zNMDjHrzfQ2yNE2595DqmjlJq GvtAsmk5FY8T8KfUhUCLRDtmY/LtQ== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 99debeb5 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 9 Feb 2020 14:30:35 +0000 (UTC) From: "Jason A. Donenfeld" To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Cc: "Jason A. Donenfeld" , Nicolas Dichtel , Steffen Klassert Subject: [PATCH net 5/5] xfrm: interface: use icmp_ndo_send helper Date: Sun, 9 Feb 2020 15:31:43 +0100 Message-Id: <20200209143143.151632-5-Jason@zx2c4.com> In-Reply-To: <20200209143143.151632-1-Jason@zx2c4.com> References: <20200209143143.151632-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Because xfrmi is calling icmp from network device context, it should use the ndo helper so that the rate limiting applies correctly. Signed-off-by: Jason A. Donenfeld Cc: Nicolas Dichtel Cc: Steffen Klassert --- net/xfrm/xfrm_interface.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index dc651a628dcf..3361e3ac5714 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -300,10 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) if (mtu < IPV6_MIN_MTU) mtu = IPV6_MIN_MTU; - icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); + icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); } else { - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, - htonl(mtu)); + icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); } dst_release(dst);