ipvs: strip gre tunnel headers from icmp errors (6aedd14b) · Commits · 戴 / test

net/netfilter/ipvs/ip_vs_core.c

+42 −4

Original line number	Diff line number	Diff line
		@@ -35,6 +35,7 @@
		#include <net/udp.h>
		#include <net/icmp.h> /* for icmp_send */
		#include <net/gue.h>
		#include <net/gre.h>
		#include <net/route.h>
		#include <net/ip6_checksum.h>
		#include <net/netns/generic.h> /* net_generic() */
		@@ -1610,6 +1611,38 @@ unk:
		return 0;
		}

		/* Check the GRE tunnel and return its header length */
		static int ipvs_gre_decap(struct netns_ipvs ipvs, struct sk_buff skb,
		unsigned int offset, __u16 af,
		const union nf_inet_addr daddr, __u8 proto)
		{
		struct gre_base_hdr _greh, *greh;
		struct ip_vs_dest *dest;

		greh = skb_header_pointer(skb, offset, sizeof(_greh), &_greh);
		if (!greh)
		goto unk;
		dest = ip_vs_find_tunnel(ipvs, af, daddr, 0);
		if (!dest)
		goto unk;
		if (dest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GRE) {
		__be16 type;

		/* Only support version 0 and C (csum) */
		if ((greh->flags & ~GRE_CSUM) != 0)
		goto unk;
		type = greh->protocol;
		/* Later we can support also IPPROTO_IPV6 */
		if (type != htons(ETH_P_IP))
		goto unk;
		*proto = IPPROTO_IPIP;
		return gre_calc_hlen(gre_flags_to_tnl_flags(greh->flags));
		}

		unk:
		return 0;
		}

		/*
		* Handle ICMP messages in the outside-to-inside direction (incoming).
		* Find any that might be relevant, check against existing connections,
		@@ -1689,7 +1722,8 @@ ip_vs_in_icmp(struct netns_ipvs ipvs, struct sk_buff skb, int *related,
		if (cih == NULL)
		return NF_ACCEPT; /* The packet looks wrong, ignore */
		ipip = true;
		} else if (cih->protocol == IPPROTO_UDP && /* Can be UDP encap */
		} else if ((cih->protocol == IPPROTO_UDP \|\| /* Can be UDP encap */
		cih->protocol == IPPROTO_GRE) && /* Can be GRE encap */
		/* Error for our tunnel must arrive at LOCAL_IN */
		(skb_rtable(skb)->rt_flags & RTCF_LOCAL)) {
		__u8 iproto;
		@@ -1699,10 +1733,14 @@ ip_vs_in_icmp(struct netns_ipvs ipvs, struct sk_buff skb, int *related,
		if (unlikely(cih->frag_off & htons(IP_OFFSET)))
		return NF_ACCEPT;
		offset2 = offset + cih->ihl * 4;
		ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET, raddr,
		&iproto);
		if (cih->protocol == IPPROTO_UDP)
		ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,
		raddr, &iproto);
		else
		ulen = ipvs_gre_decap(ipvs, skb, offset2, AF_INET,
		raddr, &iproto);
		if (ulen > 0) {
		/* Skip IP and UDP tunnel headers */
		/* Skip IP and UDP/GRE tunnel headers */
		offset = offset2 + ulen;
		/* Now we should be at the original IP header */
		cih = skb_header_pointer(skb, offset, sizeof(_ciph),

Admin message