lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 007/215] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
    Date
    From: Sabrina Dubroca <sd@queasysnail.net>

    [ Upstream commit 5eff06902394425c722f0a44d9545909a8800f79 ]

    IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to
    incomplete IPsec ACQUIRE messages being sent to userspace. Currently,
    both raw sockets and IPv6 ping sockets set those fields.

    Expected output of "ip xfrm monitor":
    acquire proto esp
    sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
    policy src 10.0.2.15/32 dst 8.8.8.8/32
    <snip>

    Currently with ping sockets:
    acquire proto esp
    sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
    policy src 10.0.2.15/32 dst 8.8.8.8/32
    <snip>

    The Libreswan test suite found this problem after Fedora changed the
    value for the sysctl net.ipv4.ping_group_range.

    Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
    Reported-by: Paul Wouters <pwouters@redhat.com>
    Tested-by: Paul Wouters <pwouters@redhat.com>
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/ping.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/net/ipv4/ping.c
    +++ b/net/ipv4/ping.c
    @@ -786,6 +786,9 @@ static int ping_v4_sendmsg(struct sock *
    inet_sk_flowi_flags(sk), faddr, saddr, 0, 0,
    sk->sk_uid);

    + fl4.fl4_icmp_type = user_icmph.type;
    + fl4.fl4_icmp_code = user_icmph.code;
    +
    security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
    rt = ip_route_output_flow(net, &fl4, sk);
    if (IS_ERR(rt)) {

    \
     
     \ /
      Last update: 2020-07-20 18:34    [W:4.068 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site