Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5aed006 authored by Hannes Frederic Sowa's avatar Hannes Frederic Sowa Committed by David S. Miller
Browse files

udp: prevent skbs lingering in tunnel socket queues 



In case we find a socket with encapsulation enabled we should call
the encap_recv function even if just a udp header without payload is
available. The callbacks are responsible for correctly verifying and
dropping the packets.

Also, in case the header validation fails for geneve and vxlan we
shouldn't put the skb back into the socket queue, no one will pick
them up there.  Instead we can simply discard them in the respective
encap_recv functions.

Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cb543e80

drivers/net/geneve.c

+3 −7
Original line number Diff line number Diff line
@@ -335,15 +335,15 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb) 


	/* Need Geneve and inner Ethernet header to be present */

	if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN)))

		goto error;

		goto drop;



	/* Return packets with reserved bits set */

	geneveh = geneve_hdr(skb);

	if (unlikely(geneveh->ver != GENEVE_VER))

		goto error;

		goto drop;



	if (unlikely(geneveh->proto_type != htons(ETH_P_TEB)))

		goto error;

		goto drop;



	gs = rcu_dereference_sk_user_data(sk);

	if (!gs)
@@ -366,10 +366,6 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb) 
	/* Consume bad packet */

	kfree_skb(skb);

	return 0;



error:

	/* Let the UDP layer deal with the skb */

	return 1;

}



static struct socket *geneve_create_sock(struct net *net, bool ipv6,

drivers/net/vxlan.c

+2 −2
Original line number Diff line number Diff line
@@ -1304,7 +1304,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) 


	/* Need UDP and VXLAN header to be present */

	if (!pskb_may_pull(skb, VXLAN_HLEN))

		return 1;

		goto drop;



	unparsed = *vxlan_hdr(skb);

	/* VNI flag always required to be set */
@@ -1313,7 +1313,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) 
			   ntohl(vxlan_hdr(skb)->vx_flags),

			   ntohl(vxlan_hdr(skb)->vx_vni));

		/* Return non vxlan pkt */

		return 1;

		goto drop;

	}

	unparsed.vx_flags &= ~VXLAN_HF_VNI;

	unparsed.vx_vni &= ~VXLAN_VNI_MASK;

net/ipv4/udp.c

+1 −1
Original line number Diff line number Diff line
@@ -1565,7 +1565,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 


		/* if we're overly short, let UDP handle it */

		encap_rcv = ACCESS_ONCE(up->encap_rcv);

		if (skb->len > sizeof(struct udphdr) && encap_rcv) {

		if (encap_rcv) {

			int ret;



			/* Verify checksum before giving to encap */

net/ipv6/udp.c

+1 −1
Original line number Diff line number Diff line
@@ -617,7 +617,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 


		/* if we're overly short, let UDP handle it */

		encap_rcv = ACCESS_ONCE(up->encap_rcv);

		if (skb->len > sizeof(struct udphdr) && encap_rcv) {

		if (encap_rcv) {

			int ret;



			/* Verify checksum before giving to encap */