Re: [PATCHv2 net-next 2/3] ip6_gre: Refactor ip6gre xmit codes

[Florian Westphal <fw@strlen.de>]

William Tu <u9012063@gmail.com> wrote:

Not related to your patch specifically but:

> +static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
> +				    struct net_device *dev,
> +				    struct flowi6 *fl6, __u8 *dsfield,
> +				    int *encap_limit)
> +{
> +	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
> +	struct ip6_tnl *t = netdev_priv(dev);
> +	__u16 offset;
> +
> +	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
> +	/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
> +
> +	if (offset > 0) {
> +		struct ipv6_tlv_tnl_enc_lim *tel;
> +
> +		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
> +		if (tel->encap_limit == 0) {
> +			icmpv6_send(skb, ICMPV6_PARAMPROB,
> +				    ICMPV6_HDR_FIELD, offset + 2);

Doing this from ndo_start_xmit is error prone, the address information
in the packet might have already been rewritten by netfilter postrouting
hooks.

So either we must find a way to never emit any error packets
at this late stage (i.e., catch this in upper layer before POST_ROUTING
hook, or, (only alternative I see) add nfct query calls into the icmp
send function to obtain the correct destination address (original
source address) from conntrack.