netdev - Re: [PATCHv2 net-next 2/3] ip6_gre: Refactor ip6gre xmit codes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Nov 2017 01:31:25 +0100
From:   Florian Westphal <fw@...len.de>
To:     William Tu <u9012063@...il.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCHv2 net-next 2/3] ip6_gre: Refactor ip6gre xmit codes

William Tu <u9012063@...il.com> wrote:

Not related to your patch specifically but:

> +static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
> +				    struct net_device *dev,
> +				    struct flowi6 *fl6, __u8 *dsfield,
> +				    int *encap_limit)
> +{
> +	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
> +	struct ip6_tnl *t = netdev_priv(dev);
> +	__u16 offset;
> +
> +	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
> +	/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
> +
> +	if (offset > 0) {
> +		struct ipv6_tlv_tnl_enc_lim *tel;
> +
> +		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
> +		if (tel->encap_limit == 0) {
> +			icmpv6_send(skb, ICMPV6_PARAMPROB,
> +				    ICMPV6_HDR_FIELD, offset + 2);

Doing this from ndo_start_xmit is error prone, the address information
in the packet might have already been rewritten by netfilter postrouting
hooks.

So either we must find a way to never emit any error packets
at this late stage (i.e., catch this in upper layer before POST_ROUTING
hook, or, (only alternative I see) add nfct query calls into the icmp
send function to obtain the correct destination address (original
source address) from conntrack.