Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6b3ef5e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

Merge tag 'ipvs-for-v4.10' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs-next 



Simon Horman says:

====================
IPVS Updates for v4.10

please consider these enhancements to the IPVS for v4.10.

* Decrement the IP ttl in all the modes in order to prevent infinite
  route loops. Thanks to Dwip Banerjee.
* Use IS_ERR_OR_NULL macro. Clean-up from Gao Feng.
====================

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parents a7647080 8d8e20e2

net/netfilter/ipvs/ip_vs_ctl.c

+1 −1
Original line number Diff line number Diff line
@@ -3260,7 +3260,7 @@ static int ip_vs_genl_dump_dests(struct sk_buff *skb, 




	svc = ip_vs_genl_find_service(ipvs, attrs[IPVS_CMD_ATTR_SERVICE]);

	if (IS_ERR(svc) || svc == NULL)

	if (IS_ERR_OR_NULL(svc))

		goto out_err;



	/* Dump the destinations */

net/netfilter/ipvs/ip_vs_xmit.c

+54 −0
Original line number Diff line number Diff line
@@ -254,6 +254,54 @@ static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af, 
	return true;

}



static inline bool decrement_ttl(struct netns_ipvs *ipvs,

				 int skb_af,

				 struct sk_buff *skb)

{

	struct net *net = ipvs->net;



#ifdef CONFIG_IP_VS_IPV6

	if (skb_af == AF_INET6) {

		struct dst_entry *dst = skb_dst(skb);



		/* check and decrement ttl */

		if (ipv6_hdr(skb)->hop_limit <= 1) {

			/* Force OUTPUT device used as source address */

			skb->dev = dst->dev;

			icmpv6_send(skb, ICMPV6_TIME_EXCEED,

				    ICMPV6_EXC_HOPLIMIT, 0);

			__IP6_INC_STATS(net, ip6_dst_idev(dst),

					IPSTATS_MIB_INHDRERRORS);



			return false;

		}



		/* don't propagate ttl change to cloned packets */

		if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))

			return false;



		ipv6_hdr(skb)->hop_limit--;

	} else

#endif

	{

		if (ip_hdr(skb)->ttl <= 1) {

			/* Tell the sender its packet died... */

			__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);

			icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);

			return false;

		}



		/* don't propagate ttl change to cloned packets */

		if (!skb_make_writable(skb, sizeof(struct iphdr)))

			return false;



		/* Decrease ttl */

		ip_decrease_ttl(ip_hdr(skb));

	}



	return true;

}



/* Get route to destination or remote server */

static int

__ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,
@@ -326,6 +374,9 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, 
		return local;

	}



	if (!decrement_ttl(ipvs, skb_af, skb))

		goto err_put;



	if (likely(!(rt_mode & IP_VS_RT_MODE_TUNNEL))) {

		mtu = dst_mtu(&rt->dst);

	} else {
@@ -473,6 +524,9 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, 
		return local;

	}



	if (!decrement_ttl(ipvs, skb_af, skb))

		goto err_put;



	/* MTU checking */

	if (likely(!(rt_mode & IP_VS_RT_MODE_TUNNEL)))

		mtu = dst_mtu(&rt->dst);