[SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

[SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Kelsey Skunberg
BugLink: https://bugs.launchpad.net/bugs/1860969

SRU Justification:

[Impact]
Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
socket are dropped (no carrier).

The bug exists since the beginning of each driver.

[Fix]
This has been fixed in v5.5 by the following upstream commits
 - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
 - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe

Backport the requested patches to Eoan (5.3), Bionic (4.15) and
Xenial (4.4).

Patches have already been applied to 5.4 focal tree through upstream stable
updates.

[Testcase]
Can be reproduced and tested with an AF_PACKET socket and python script which
is included in both mentioned patches.

[Risk of Regression]
This patch affects only the cases described above (when no dst is attached
to the skb), thus the risk should be low.

Changes in v2:
  - organize SRU Justification information to be listed under proper
    catergories
  - limit lines to 80 characters

Nicolas Dichtel (2):
  vti[6]: fix packet tx through bpf_redirect()
  xfrm interface: fix packet tx through bpf_redirect()

 net/ipv4/ip_vti.c         | 13 +++++++++++--
 net/ipv6/ip6_vti.c        | 13 +++++++++++--
 net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
 3 files changed, 47 insertions(+), 11 deletions(-)

--
2.20.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[SRU][F/E/B/X][PATCH v2 1/2] vti[6]: fix packet tx through bpf_redirect()

Kelsey Skunberg
From: Nicolas Dichtel <[hidden email]>

BugLink: https://bugs.launchpad.net/bugs/1860969

With an ebpf program that redirects packets through a vti[6] interface,
the packets are dropped because no dst is attached.

This could also be reproduced with an AF_PACKET socket, with the following
python script (vti1 is an ip_vti interface):

 import socket
 send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
 # scapy
 # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
 # raw(p)
 req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
 send_s.sendto(req, ('vti1', 0x800, 0, 0))

Signed-off-by: Nicolas Dichtel <[hidden email]>
Signed-off-by: Steffen Klassert <[hidden email]>
(cherry picked from commit 95224166a9032ff5d08fca633d37113078ce7d01)
Signed-off-by: Kelsey Skunberg <[hidden email]>
---
 net/ipv4/ip_vti.c  | 13 +++++++++++--
 net/ipv6/ip6_vti.c | 13 +++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index cfb025606793..8064e5750b65 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -187,8 +187,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
  int mtu;
 
  if (!dst) {
- dev->stats.tx_carrier_errors++;
- goto tx_error_icmp;
+ struct rtable *rt;
+
+ fl->u.ip4.flowi4_oif = dev->ifindex;
+ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
+ if (IS_ERR(rt)) {
+ dev->stats.tx_carrier_errors++;
+ goto tx_error_icmp;
+ }
+ dst = &rt->dst;
+ skb_dst_set(skb, dst);
  }
 
  dst_hold(dst);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 4aa31ccd8a33..f11916120ef3 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -449,8 +449,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
  int err = -1;
  int mtu;
 
- if (!dst)
- goto tx_err_link_failure;
+ if (!dst) {
+ fl->u.ip6.flowi6_oif = dev->ifindex;
+ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ dst = NULL;
+ goto tx_err_link_failure;
+ }
+ skb_dst_set(skb, dst);
+ }
 
  dst_hold(dst);
  dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
--
2.20.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[SRU][F/E/B/X][PATCH v2 2/2] xfrm interface: fix packet tx through bpf_redirect()

Kelsey Skunberg
In reply to this post by Kelsey Skunberg
From: Nicolas Dichtel <[hidden email]>

BugLink: https://bugs.launchpad.net/bugs/1860969

With an ebpf program that redirects packets through a xfrm interface,
packets are dropped because no dst is attached to skb.

This could also be reproduced with an AF_PACKET socket, with the following
python script (xfrm1 is a xfrm interface):

 import socket
 send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
 # scapy
 # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
 # raw(p)
 req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
 send_s.sendto(req, ('xfrm1', 0x800, 0, 0))

It was also not possible to send an ip packet through an AF_PACKET socket
because a LL header was expected. Let's remove those LL header constraints.

Signed-off-by: Nicolas Dichtel <[hidden email]>
Signed-off-by: Steffen Klassert <[hidden email]>
(cherry picked from commit f042365dbffea98fb8148c98c700402e8d099f02)
Signed-off-by: Kelsey Skunberg <[hidden email]>
---
 net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 2ab4859df55a..6809b96714e5 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
  int err = -1;
  int mtu;
 
- if (!dst)
- goto tx_err_link_failure;
-
  dst_hold(dst);
  dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
  if (IS_ERR(dst)) {
@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 {
  struct xfrm_if *xi = netdev_priv(dev);
  struct net_device_stats *stats = &xi->dev->stats;
+ struct dst_entry *dst = skb_dst(skb);
  struct flowi fl;
  int ret;
 
@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
  case htons(ETH_P_IPV6):
  xfrm_decode_session(skb, &fl, AF_INET6);
  memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ if (!dst) {
+ fl.u.ip6.flowi6_oif = dev->ifindex;
+ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+ if (dst->error) {
+ dst_release(dst);
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, dst);
+ }
  break;
  case htons(ETH_P_IP):
  xfrm_decode_session(skb, &fl, AF_INET);
  memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ if (!dst) {
+ struct rtable *rt;
+
+ fl.u.ip4.flowi4_oif = dev->ifindex;
+ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
+ if (IS_ERR(rt)) {
+ stats->tx_carrier_errors++;
+ goto tx_err;
+ }
+ skb_dst_set(skb, &rt->dst);
+ }
  break;
  default:
  goto tx_err;
@@ -563,12 +584,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
 {
  dev->netdev_ops = &xfrmi_netdev_ops;
  dev->type = ARPHRD_NONE;
- dev->hard_header_len = ETH_HLEN;
- dev->min_header_len = ETH_HLEN;
  dev->mtu = ETH_DATA_LEN;
  dev->min_mtu = ETH_MIN_MTU;
- dev->max_mtu = ETH_DATA_LEN;
- dev->addr_len = ETH_ALEN;
+ dev->max_mtu = IP_MAX_MTU;
  dev->flags = IFF_NOARP;
  dev->needs_free_netdev = true;
  dev->priv_destructor = xfrmi_dev_free;
--
2.20.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Kamal Mostafa-2
In reply to this post by Kelsey Skunberg
LGTM.

Acked-by: Kamal Mostafa <[hidden email]>

 -Kamal

On Wed, Feb 12, 2020 at 11:07:27AM -0700, Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> SRU Justification:
>
> [Impact]
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
> socket are dropped (no carrier).
>
> The bug exists since the beginning of each driver.
>
> [Fix]
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Backport the requested patches to Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> Patches have already been applied to 5.4 focal tree through upstream stable
> updates.
>
> [Testcase]
> Can be reproduced and tested with an AF_PACKET socket and python script which
> is included in both mentioned patches.
>
> [Risk of Regression]
> This patch affects only the cases described above (when no dst is attached
> to the skb), thus the risk should be low.
>
> Changes in v2:
>   - organize SRU Justification information to be listed under proper
>     catergories
>   - limit lines to 80 characters
>
> Nicolas Dichtel (2):
>   vti[6]: fix packet tx through bpf_redirect()
>   xfrm interface: fix packet tx through bpf_redirect()
>
>  net/ipv4/ip_vti.c         | 13 +++++++++++--
>  net/ipv6/ip6_vti.c        | 13 +++++++++++--
>  net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>  3 files changed, 47 insertions(+), 11 deletions(-)
>
> --
> 2.20.1
>
>
> --
> kernel-team mailing list
> [hidden email]
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Kleber Souza
In reply to this post by Kelsey Skunberg
On 12.02.20 19:07, Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> SRU Justification:
>
> [Impact]
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
> socket are dropped (no carrier).
>
> The bug exists since the beginning of each driver.
>
> [Fix]
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Backport the requested patches to Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> Patches have already been applied to 5.4 focal tree through upstream stable
> updates.
>
> [Testcase]
> Can be reproduced and tested with an AF_PACKET socket and python script which
> is included in both mentioned patches.
>
> [Risk of Regression]
> This patch affects only the cases described above (when no dst is attached
> to the skb), thus the risk should be low.
>
> Changes in v2:
>   - organize SRU Justification information to be listed under proper
>     catergories
>   - limit lines to 80 characters
>
> Nicolas Dichtel (2):
>   vti[6]: fix packet tx through bpf_redirect()
>   xfrm interface: fix packet tx through bpf_redirect()
>
>  net/ipv4/ip_vti.c         | 13 +++++++++++--
>  net/ipv6/ip6_vti.c        | 13 +++++++++++--
>  net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>  3 files changed, 47 insertions(+), 11 deletions(-)
>

Acked-by: Kleber Sacilotto de Souza <[hidden email]>

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

Re: [SRU][F/E/B/X][PATCH 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Khaled Elmously
In reply to this post by Kelsey Skunberg
Maybe I'm doing something wrong, but I can't seem to apply either one, or both, patches to all of X, B and E.

Kelsey, could you please double check that both patches apply to all of the series to which you're nominating them?



On 2020-02-10 09:59:15 , Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> [SRU Justification]
>
> [Impact]
>
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET socket are dropped (no carrier).
>
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> The bug exists since the beginning of each driver.
>
> == Fix ==
>
> Backport the requested patches to Focal (5.4), Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> == Risk of Regression ==
>
> This patch affects only the cases described above (when no dst is attached to the skb), thus the risk should be low.
>
> Nicolas Dichtel (2):
>   vti[6]: fix packet tx through bpf_redirect()
>   xfrm interface: fix packet tx through bpf_redirect()
>
>  net/ipv4/ip_vti.c         | 13 +++++++++++--
>  net/ipv6/ip6_vti.c        | 13 +++++++++++--
>  net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>  3 files changed, 47 insertions(+), 11 deletions(-)
>
> --
> 2.20.1
>
>
> --
> kernel-team mailing list
> [hidden email]
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

NAK[B/X]: [SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Kleber Souza
In reply to this post by Kelsey Skunberg
On 12.02.20 19:07, Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> SRU Justification:
>
> [Impact]
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
> socket are dropped (no carrier).
>
> The bug exists since the beginning of each driver.
>
> [Fix]
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Backport the requested patches to Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> Patches have already been applied to 5.4 focal tree through upstream stable
> updates.
>
> [Testcase]
> Can be reproduced and tested with an AF_PACKET socket and python script which
> is included in both mentioned patches.
>
> [Risk of Regression]
> This patch affects only the cases described above (when no dst is attached
> to the skb), thus the risk should be low.
>
> Changes in v2:
>   - organize SRU Justification information to be listed under proper
>     catergories
>   - limit lines to 80 characters
>
> Nicolas Dichtel (2):
>   vti[6]: fix packet tx through bpf_redirect()
>   xfrm interface: fix packet tx through bpf_redirect()
>
>  net/ipv4/ip_vti.c         | 13 +++++++++++--
>  net/ipv6/ip6_vti.c        | 13 +++++++++++--
>  net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>  3 files changed, 47 insertions(+), 11 deletions(-)
>

Hi Kelsey,

These patches can be applied cleanly to Eoan, but they don't apply
to Bionic and Xenial. On these two series, the file changed by
patch 2/2 (net/xfrm/xfrm_interface.c) doesn't even exist. This mean
that these patches need to be backported for these older series.

So I will apply the patches to Eoan (reply message coming shortly)
and will NAK for Bionic and Xenial.


Thanks,
Kleber


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

APPLIED[E]: [SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Kleber Souza
In reply to this post by Kelsey Skunberg
On 12.02.20 19:07, Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> SRU Justification:
>
> [Impact]
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
> socket are dropped (no carrier).
>
> The bug exists since the beginning of each driver.
>
> [Fix]
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Backport the requested patches to Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> Patches have already been applied to 5.4 focal tree through upstream stable
> updates.
>
> [Testcase]
> Can be reproduced and tested with an AF_PACKET socket and python script which
> is included in both mentioned patches.
>
> [Risk of Regression]
> This patch affects only the cases described above (when no dst is attached
> to the skb), thus the risk should be low.
>
> Changes in v2:
>   - organize SRU Justification information to be listed under proper
>     catergories
>   - limit lines to 80 characters
>
> Nicolas Dichtel (2):
>   vti[6]: fix packet tx through bpf_redirect()
>   xfrm interface: fix packet tx through bpf_redirect()
>
>  net/ipv4/ip_vti.c         | 13 +++++++++++--
>  net/ipv6/ip6_vti.c        | 13 +++++++++++--
>  net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
>  3 files changed, 47 insertions(+), 11 deletions(-)
>

Applied *only* to eoan/linux.

Thanks,
Kleber

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

NAK[F]: [SRU][F/E/B/X][PATCH v2 0/2] ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets

Seth Forshee
In reply to this post by Kelsey Skunberg
On Wed, Feb 12, 2020 at 11:07:27AM -0700, Kelsey Skunberg wrote:

> BugLink: https://bugs.launchpad.net/bugs/1860969
>
> SRU Justification:
>
> [Impact]
> Packets sent to a vti[6]/xfrm interface via bpf_redirect() or via an AF_PACKET
> socket are dropped (no carrier).
>
> The bug exists since the beginning of each driver.
>
> [Fix]
> This has been fixed in v5.5 by the following upstream commits
>  - 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()")
>  - f042365dbffe ("xfrm interface: fix packet tx through bpf_redirect()")
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95224166a903
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f042365dbffe
>
> Backport the requested patches to Eoan (5.3), Bionic (4.15) and
> Xenial (4.4).
>
> Patches have already been applied to 5.4 focal tree through upstream stable
> updates.
>
> [Testcase]
> Can be reproduced and tested with an AF_PACKET socket and python script which
> is included in both mentioned patches.
>
> [Risk of Regression]
> This patch affects only the cases described above (when no dst is attached
> to the skb), thus the risk should be low.

Focal already has these patches, so NAK there.

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team