| Message ID | e14ad6ba2a92a44a8b146e57e8fcdb10fb906226.1593767365.git.sd@queasysnail.net |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg | expand |
From: Sabrina Dubroca <sd@queasysnail.net> Date: Fri, 3 Jul 2020 17:00:32 +0200 > IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to > incomplete IPsec ACQUIRE messages being sent to userspace. Currently, > both raw sockets and IPv6 ping sockets set those fields. > > Expected output of "ip xfrm monitor": > acquire proto esp > sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4 > policy src 10.0.2.15/32 dst 8.8.8.8/32 > <snip> > > Currently with ping sockets: > acquire proto esp > sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4 > policy src 10.0.2.15/32 dst 8.8.8.8/32 > <snip> > > The Libreswan test suite found this problem after Fedora changed the > value for the sysctl net.ipv4.ping_group_range. > > Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") > Reported-by: Paul Wouters <pwouters@redhat.com> > Tested-by: Paul Wouters <pwouters@redhat.com> > Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Applied and queued up for -stable, thank you.
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 535427292194..df6fbefe44d4 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -786,6 +786,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) inet_sk_flowi_flags(sk), faddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type = user_icmph.type; + fl4.fl4_icmp_code = user_icmph.code; + security_sk_classify_flow(sk, flowi4_to_flowi(&fl4)); rt = ip_route_output_flow(net, &fl4, sk); if (IS_ERR(rt)) {
IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to incomplete IPsec ACQUIRE messages being sent to userspace. Currently, both raw sockets and IPv6 ping sockets set those fields. Expected output of "ip xfrm monitor": acquire proto esp sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4 policy src 10.0.2.15/32 dst 8.8.8.8/32 <snip> Currently with ping sockets: acquire proto esp sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4 policy src 10.0.2.15/32 dst 8.8.8.8/32 <snip> The Libreswan test suite found this problem after Fedora changed the value for the sysctl net.ipv4.ping_group_range. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Paul Wouters <pwouters@redhat.com> Tested-by: Paul Wouters <pwouters@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- net/ipv4/ping.c | 3 +++ 1 file changed, 3 insertions(+)