mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
With a raw socket bound to IPPROTO_RAW (ie with hdrincl enabled), the
protocol field of the flow structure, build by raw_sendmsg() /
rawv6_sendmsg()), is set to IPPROTO_RAW. This breaks the ipsec policy
lookup when some policies are defined with a protocol in the selector.
For ipv6, the sin6_port field from 'struct sockaddr_in6' could be used to
specify the protocol. Just accept all values for IPPROTO_RAW socket.
For ipv4, the sin_port field of 'struct sockaddr_in' could not be used
without breaking backward compatibility (the value of this field was never
checked). Let's add a new kind of control message, so that the userland
could specify which protocol is used.
Fixes: 1da177e4c3
("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://lore.kernel.org/r/20230522120820.1319391-1-nicolas.dichtel@6wind.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
parent
6007612459
commit
3632679d9e
|
@ -76,6 +76,7 @@ struct ipcm_cookie {
|
|||
__be32 addr;
|
||||
int oif;
|
||||
struct ip_options_rcu *opt;
|
||||
__u8 protocol;
|
||||
__u8 ttl;
|
||||
__s16 tos;
|
||||
char priority;
|
||||
|
@ -96,6 +97,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm,
|
|||
ipcm->sockc.tsflags = inet->sk.sk_tsflags;
|
||||
ipcm->oif = READ_ONCE(inet->sk.sk_bound_dev_if);
|
||||
ipcm->addr = inet->inet_saddr;
|
||||
ipcm->protocol = inet->inet_num;
|
||||
}
|
||||
|
||||
#define IPCB(skb) ((struct inet_skb_parm*)((skb)->cb))
|
||||
|
|
|
@ -163,6 +163,7 @@ struct in_addr {
|
|||
#define IP_MULTICAST_ALL 49
|
||||
#define IP_UNICAST_IF 50
|
||||
#define IP_LOCAL_PORT_RANGE 51
|
||||
#define IP_PROTOCOL 52
|
||||
|
||||
#define MCAST_EXCLUDE 0
|
||||
#define MCAST_INCLUDE 1
|
||||
|
|
|
@ -317,7 +317,14 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
|
|||
ipc->tos = val;
|
||||
ipc->priority = rt_tos2priority(ipc->tos);
|
||||
break;
|
||||
|
||||
case IP_PROTOCOL:
|
||||
if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
|
||||
return -EINVAL;
|
||||
val = *(int *)CMSG_DATA(cmsg);
|
||||
if (val < 1 || val > 255)
|
||||
return -EINVAL;
|
||||
ipc->protocol = val;
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
@ -1761,6 +1768,9 @@ int do_ip_getsockopt(struct sock *sk, int level, int optname,
|
|||
case IP_LOCAL_PORT_RANGE:
|
||||
val = inet->local_port_range.hi << 16 | inet->local_port_range.lo;
|
||||
break;
|
||||
case IP_PROTOCOL:
|
||||
val = inet_sk(sk)->inet_num;
|
||||
break;
|
||||
default:
|
||||
sockopt_release_sock(sk);
|
||||
return -ENOPROTOOPT;
|
||||
|
|
|
@ -532,6 +532,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
|
|||
}
|
||||
|
||||
ipcm_init_sk(&ipc, inet);
|
||||
/* Keep backward compat */
|
||||
if (hdrincl)
|
||||
ipc.protocol = IPPROTO_RAW;
|
||||
|
||||
if (msg->msg_controllen) {
|
||||
err = ip_cmsg_send(sk, msg, &ipc, false);
|
||||
|
@ -599,7 +602,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
|
|||
|
||||
flowi4_init_output(&fl4, ipc.oif, ipc.sockc.mark, tos,
|
||||
RT_SCOPE_UNIVERSE,
|
||||
hdrincl ? IPPROTO_RAW : sk->sk_protocol,
|
||||
hdrincl ? ipc.protocol : sk->sk_protocol,
|
||||
inet_sk_flowi_flags(sk) |
|
||||
(hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
|
||||
daddr, saddr, 0, 0, sk->sk_uid);
|
||||
|
|
|
@ -793,7 +793,8 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
|
|||
|
||||
if (!proto)
|
||||
proto = inet->inet_num;
|
||||
else if (proto != inet->inet_num)
|
||||
else if (proto != inet->inet_num &&
|
||||
inet->inet_num != IPPROTO_RAW)
|
||||
return -EINVAL;
|
||||
|
||||
if (proto > 255)
|
||||
|
|
Loading…
Reference in a new issue