[INET]: Move no-tunnel ICMP error to tunnel4/tunnel6

This patch moves the sending of ICMP messages when there are no IPv4/IPv6
tunnels present to tunnel4/tunnel6 respectively.  Please note that for now
if xfrm4_tunnel/xfrm6_tunnel is loaded then no ICMP messages will ever be
sent.  This is similar to how we handle AH/ESP/IPCOMP.

This move fixes the bug where we always send an ICMP message when there is
no ip6_tunnel device present for a given packet even if it is later handled
by IPsec.  It also causes ICMP messages to be sent when no IPIP tunnel is
present.

I've decided to use the "port unreachable" ICMP message over the current
value of "address unreachable" (and "protocol unreachable" by GRE) because
it is not ambiguous unlike the other ones which can be triggered by other
conditions.  There seems to be no standard specifying what value must be
used so this change should be OK.  In fact we should change GRE to use
this value as well.

Incidentally, this patch also fixes a fairly serious bug in xfrm6_tunnel
where we don't check whether the embedded IPv6 header is present before
dereferencing it for the inside source address.

This patch is inspired by a previous patch by Hugo Santos <hsantos@av.it.pt>.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index eef07b0916a3da9e875ef6652ec4e6c204ebdc4d..ea398ee43f28740d6b75eee0efe5ecdcd97c54ee 100644 (file)
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -474,9 +474,6 @@ static int ipip_rcv(struct sk_buff *skb)
        struct iphdr *iph;
        struct ip_tunnel *tunnel;
 
-       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-               goto out;
-
        iph = skb->nh.iph;
 
        read_lock(&ipip_lock);
@@ -508,7 +505,6 @@ static int ipip_rcv(struct sk_buff *skb)
        }
        read_unlock(&ipip_lock);
 
-out:
        return -1;
 }
 

diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index 0d7d386dac2287bbfb9ef42ec6bbf0d83bb5073f..8d30c48f090e59dd9ac96b40252b0ac4c9099246 100644 (file)
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -8,6 +8,8 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/icmp.h>
+#include <net/ip.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
@@ -70,10 +72,16 @@ static int tunnel4_rcv(struct sk_buff *skb)
 {
        struct xfrm_tunnel *handler;
 
+       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+               goto drop;
+
        for (handler = tunnel4_handlers; handler; handler = handler->next)
                if (!handler->handler(skb))
                        return 0;
 
+       icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+drop:
        kfree_skb(skb);
        return 0;
 }

diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 7a0b9524fe086b9e6636af41f4de4ca3f5000696..3e174c83bfe7a805fe40d446d7114124453b0d9f 100644 (file)
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -37,8 +37,6 @@ static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
 {
        switch (nexthdr) {
        case IPPROTO_IPIP:
-               if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-                       return -EINVAL;
                *spi = skb->nh.iph->saddr;
                *seq = 0;
                return 0;

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ff9040c92556d20fb453b5ff815e402dc6c6ff60..a995796b5a577fb7b0f4a947d54a85897143a1ab 100644 (file)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -519,9 +519,6 @@ ip6ip6_rcv(struct sk_buff *skb)
        struct ipv6hdr *ipv6h;
        struct ip6_tnl *t;
 
-       if (!pskb_may_pull(skb, sizeof (*ipv6h)))
-               goto discard;
-
        ipv6h = skb->nh.ipv6h;
 
        read_lock(&ip6ip6_lock);
@@ -529,8 +526,7 @@ ip6ip6_rcv(struct sk_buff *skb)
        if ((t = ip6ip6_tnl_lookup(&ipv6h->saddr, &ipv6h->daddr)) != NULL) {
                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                        read_unlock(&ip6ip6_lock);
-                       kfree_skb(skb);
-                       return 0;
+                       goto discard;
                }
 
                if (!(t->parms.flags & IP6_TNL_F_CAP_RCV)) {
@@ -557,9 +553,11 @@ ip6ip6_rcv(struct sk_buff *skb)
                return 0;
        }
        read_unlock(&ip6ip6_lock);
-       icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, skb->dev);
-discard:
        return 1;
+
+discard:
+       kfree_skb(skb);
+       return 0;
 }
 
 static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)

diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 5659b52284bd55518960460d49a391a6f5ee8dac..0ef9a35798d13915eb158e54ee58800ca058168a 100644 (file)
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -19,11 +19,13 @@
  *             YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  */
 
+#include <linux/icmpv6.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
@@ -87,10 +89,16 @@ static int tunnel6_rcv(struct sk_buff **pskb)
        struct sk_buff *skb = *pskb;
        struct xfrm6_tunnel *handler;
 
+       if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+               goto drop;
+
        for (handler = tunnel6_handlers; handler; handler = handler->next)
                if (!handler->handler(skb))
                        return 0;
 
+       icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+
+drop:
        kfree_skb(skb);
        return 0;
 }