Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 65faac3c authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Greg Kroah-Hartman
Browse files

UPSTREAM: wireguard: device: use icmp_ndo_send helper 



Because wireguard is calling icmp from network device context, it should
use the ndo helper so that the rate limiting applies correctly.  This
commit adds a small test to the wireguard test suite to ensure that the
new functions continue doing the right thing in the context of
wireguard. It does this by setting up a condition that will definately
evoke an icmp error message from the driver, but along a nat'd path.

Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
(cherry picked from commit a12d7f3cbdc72c7625881c8dc2660fc2c979fdf2)
Bug: 152722841
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifb36defa0c8d6dc7d51884078826f5b6ca793bfd
parent a6ad6baf

drivers/net/wireguard/device.c

+2 −2
Original line number Diff line number Diff line
@@ -203,9 +203,9 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) 
err:

	++dev->stats.tx_errors;

	if (skb->protocol == htons(ETH_P_IP))

		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);

		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);

	else if (skb->protocol == htons(ETH_P_IPV6))

		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);

		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);

	kfree_skb(skb);

	return ret;

}

tools/testing/selftests/wireguard/netns.sh

+11 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
set -e



exec 3>&1

export LANG=C

export WG_HIDE_KEYS=never

netns0="wg-test-$$-0"

netns1="wg-test-$$-1"
@@ -297,7 +298,17 @@ ip1 -4 rule add table main suppress_prefixlength 0 
n1 ping -W 1 -c 100 -f 192.168.99.7

n1 ping -W 1 -c 100 -f abab::1111



# Have ns2 NAT into wg0 packets from ns0, but return an icmp error along the right route.

n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SNAT --to 192.168.241.2

n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manual rpfilter just to be explicit.

n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'

ip0 -4 route add 192.168.241.1 via 10.0.0.100

n2 wg set wg0 peer "$pub1" remove

[[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) == *"From 10.0.0.100 icmp_seq=1 Destination Host Unreachable"* ]]



n0 iptables -t nat -F

n0 iptables -t filter -F

n2 iptables -t nat -F

ip0 link del vethrc

ip0 link del vethrs

ip1 link del wg0