[PATCH] Can not send icmp netunreach packet

[PATCH] Can not send icmp netunreach packet

[Li Yewang]

Hi All

   There is a bug about icmp netunreach.
   If the kernel does not find a route for a packet, 
   it must send a icmp netunreach packet to the source host, 
   and  discard  the packet. But the  kernel  does not send 
   a icmp netunreach packet because of the  fib_lookup
   return value  of -ESRCH when a route  is not found. 

Signed-off-by: Li Yewang <lyw@cn.fujitsu.com>

diff -Nurp net/core_back/fib_rules.c net/core/fib_rules.c
--- net/core_back/fib_rules.c   2008-02-25 13:15:37.000000000 +0800
+++ net/core/fib_rules.c        2008-02-25 13:16:01.000000000 +0800
@@ -188,7 +188,7 @@ jumped:
 		}
 	}
 
-	err = -ESRCH;
+	err = -ENETUNREACH;
 out:
 	rcu_read_unlock();

Re: [PATCH] Can not send icmp netunreach packet

[Jarek Poplawski]

On 26-02-2008 07:34, Li Yewang wrote:
> Hi All
> 
>    There is a bug about icmp netunreach.
>    If the kernel does not find a route for a packet, 
>    it must send a icmp netunreach packet to the source host, 
>    and  discard  the packet. But the  kernel  does not send 
>    a icmp netunreach packet because of the  fib_lookup
>    return value  of -ESRCH when a route  is not found. 

...or because some function doesn't handle -ESRCH return from
fib_lookup? It seems changing this to -ESRCH was needed in some cases.
And you don't explain enough why it can't be handled later (like in
ipv4/route.c: ip_route_input_slow)?

Regards,
Jarek P.

> 
> Signed-off-by: Li Yewang <lyw@cn.fujitsu.com>
> 
> diff -Nurp net/core_back/fib_rules.c net/core/fib_rules.c
> --- net/core_back/fib_rules.c   2008-02-25 13:15:37.000000000 +0800
> +++ net/core/fib_rules.c        2008-02-25 13:16:01.000000000 +0800
> @@ -188,7 +188,7 @@ jumped:
>  		}
>  	}
>  
> -	err = -ESRCH;
> +	err = -ENETUNREACH;
>  out:
>  	rcu_read_unlock();
> 

Re: [PATCH] Can not send icmp netunreach packet

[Wei Yongjun]

Jarek Poplawski wrote:

Maybe ip_error() does not handle the ESRCH error. In this place ESRCH eq 
to ENETUNREACH?

static int ip_error(struct sk_buff *skb)
{
	struct rtable *rt = (struct rtable*)skb->dst;
	unsigned long now;
	int code;

	switch (rt->u.dst.error) {
		case EINVAL:
		default:
			goto out;
		case EHOSTUNREACH:
			code = ICMP_HOST_UNREACH;
			break;
		case ENETUNREACH:
			code = ICMP_NET_UNREACH;
			break;
		case EACCES:
			code = ICMP_PKT_FILTERED;
			break;
	}
...............snip....................
}



> On 26-02-2008 07:34, Li Yewang wrote:
>   
>> Hi All
>>
>>    There is a bug about icmp netunreach.
>>    If the kernel does not find a route for a packet, 
>>    it must send a icmp netunreach packet to the source host, 
>>    and  discard  the packet. But the  kernel  does not send 
>>    a icmp netunreach packet because of the  fib_lookup
>>    return value  of -ESRCH when a route  is not found. 
>>     
>
> ...or because some function doesn't handle -ESRCH return from
> fib_lookup? It seems changing this to -ESRCH was needed in some cases.
> And you don't explain enough why it can't be handled later (like in
> ipv4/route.c: ip_route_input_slow)?
>   


> Regards,
> Jarek P.
>
>   
>> Signed-off-by: Li Yewang <lyw@cn.fujitsu.com>
>>
>> diff -Nurp net/core_back/fib_rules.c net/core/fib_rules.c
>> --- net/core_back/fib_rules.c   2008-02-25 13:15:37.000000000 +0800
>> +++ net/core/fib_rules.c        2008-02-25 13:16:01.000000000 +0800
>> @@ -188,7 +188,7 @@ jumped:
>>  		}
>>  	}
>>  
>> -	err = -ESRCH;
>> +	err = -ENETUNREACH;
>>  out:
>>  	rcu_read_unlock();
>>
>>     

Re: [PATCH] Can not send icmp netunreach packet

[Jarek Poplawski]

On Tue, Feb 26, 2008 at 06:59:08PM +0900, Wei Yongjun wrote:
> Jarek Poplawski wrote:
>
> Maybe ip_error() does not handle the ESRCH error. In this place ESRCH eq  
> to ENETUNREACH?

It doesn't handle ESRCH for sure... Current solution seems to expect
it is changed earlier to ENETUNREACH. It looks reasonable because
otherwise all other places checking for this should be updated too.

But, IMHO, it could be tested if such a change here helps in current
problem, and then maybe found where it was skipped? On the other hand,
probably checking with grep for all such ENETUNREACH cases, and adding
ESRCH where needed could be much simpler and safer...

Jarek P.

>
> static int ip_error(struct sk_buff *skb)
> {
> 	struct rtable *rt = (struct rtable*)skb->dst;
> 	unsigned long now;
> 	int code;
>
> 	switch (rt->u.dst.error) {
> 		case EINVAL:
> 		default:
> 			goto out;
> 		case EHOSTUNREACH:
> 			code = ICMP_HOST_UNREACH;
> 			break;
> 		case ENETUNREACH:
> 			code = ICMP_NET_UNREACH;
> 			break;
> 		case EACCES:
> 			code = ICMP_PKT_FILTERED;
> 			break;
> 	}
> ...............snip....................
> }
>
>
>
>> On 26-02-2008 07:34, Li Yewang wrote:
>>   
>>> Hi All
>>>
>>>    There is a bug about icmp netunreach.
>>>    If the kernel does not find a route for a packet,    it must send 
>>> a icmp netunreach packet to the source host,    and  discard  the 
>>> packet. But the  kernel  does not send    a icmp netunreach packet 
>>> because of the  fib_lookup
>>>    return value  of -ESRCH when a route  is not found.     
>>
>> ...or because some function doesn't handle -ESRCH return from
>> fib_lookup? It seems changing this to -ESRCH was needed in some cases.
>> And you don't explain enough why it can't be handled later (like in
>> ipv4/route.c: ip_route_input_slow)?
>>   
>
>
>> Regards,
>> Jarek P.
>>
>>   
>>> Signed-off-by: Li Yewang <lyw@cn.fujitsu.com>
>>>
>>> diff -Nurp net/core_back/fib_rules.c net/core/fib_rules.c
>>> --- net/core_back/fib_rules.c   2008-02-25 13:15:37.000000000 +0800
>>> +++ net/core/fib_rules.c        2008-02-25 13:16:01.000000000 +0800
>>> @@ -188,7 +188,7 @@ jumped:
>>>  		}
>>>  	}
>>>  -	err = -ESRCH;
>>> +	err = -ENETUNREACH;
>>>  out:
>>>  	rcu_read_unlock();
>>>
>>>     
>

Re: [PATCH] Can not send icmp netunreach packet

[Stephen Hemminger]

On Tue, 26 Feb 2008 18:59:08 +0900
Wei Yongjun <yjwei@cn.fujitsu.com> wrote:

> Jarek Poplawski wrote:
> 
> Maybe ip_error() does not handle the ESRCH error. In this place ESRCH eq 
> to ENETUNREACH?
> 
> static int ip_error(struct sk_buff *skb)
> {
> 	struct rtable *rt = (struct rtable*)skb->dst;
> 	unsigned long now;
> 	int code;
> 
> 	switch (rt->u.dst.error) {
> 		case EINVAL:
> 		default:
> 			goto out;
> 		case EHOSTUNREACH:
> 			code = ICMP_HOST_UNREACH;
> 			break;
> 		case ENETUNREACH:
> 			code = ICMP_NET_UNREACH;
> 			break;
> 		case EACCES:
> 			code = ICMP_PKT_FILTERED;
> 			break;
> 	}
> ...............snip....................
> }
> 
> 
> 
> > On 26-02-2008 07:34, Li Yewang wrote:
> >   
> >> Hi All
> >>
> >>    There is a bug about icmp netunreach.
> >>    If the kernel does not find a route for a packet, 
> >>    it must send a icmp netunreach packet to the source host, 
> >>    and  discard  the packet. But the  kernel  does not send 
> >>    a icmp netunreach packet because of the  fib_lookup
> >>    return value  of -ESRCH when a route  is not found. 
> >>     
> >
> > ...or because some function doesn't handle -ESRCH return from
> > fib_lookup? It seems changing this to -ESRCH was needed in some cases.
> > And you don't explain enough why it can't be handled later (like in
> > ipv4/route.c: ip_route_input_slow)?
> >   
> 
> 
> > Regards,
> > Jarek P.
> >
> >   
> >> Signed-off-by: Li Yewang <lyw@cn.fujitsu.com>
> >>
> >> diff -Nurp net/core_back/fib_rules.c net/core/fib_rules.c
> >> --- net/core_back/fib_rules.c   2008-02-25 13:15:37.000000000 +0800
> >> +++ net/core/fib_rules.c        2008-02-25 13:16:01.000000000 +0800
> >> @@ -188,7 +188,7 @@ jumped:
> >>  		}
> >>  	}
> >>  
> >> -	err = -ESRCH;
> >> +	err = -ENETUNREACH;
> >>  out:
> >>  	rcu_read_unlock();
> >>
> >>     

The switch shouldn't see a problem because ENETUNREACH is already substituted
for ESRCH in:


static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
			       u8 tos, struct net_device *dev)
{
...
	/*
	 *	Now we are ready to route packet.
	 */
	if ((err = fib_lookup(net, &fl, &res)) != 0) {
		if (!IN_DEV_FORWARD(in_dev))
			goto e_hostunreach;
		goto no_route;

...
no_route:
	RT_CACHE_STAT_INC(in_no_route);
	spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
	res.type = RTN_UNREACHABLE;
	if (err == -ESRCH)
		err = -ENETUNREACH;
	goto local_input;

Re: [PATCH] Can not send icmp netunreach packet

[David Miller]

From: Jarek Poplawski <jarkao2@gmail.com>
Date: Tue, 26 Feb 2008 07:35:38 +0000

> On 26-02-2008 07:34, Li Yewang wrote:
> > Hi All
> > 
> >    There is a bug about icmp netunreach.
> >    If the kernel does not find a route for a packet, 
> >    it must send a icmp netunreach packet to the source host, 
> >    and  discard  the packet. But the  kernel  does not send 
> >    a icmp netunreach packet because of the  fib_lookup
> >    return value  of -ESRCH when a route  is not found. 
> 
> ...or because some function doesn't handle -ESRCH return from
> fib_lookup? It seems changing this to -ESRCH was needed in some cases.
> And you don't explain enough why it can't be handled later (like in
> ipv4/route.c: ip_route_input_slow)?

This was changed to -ESRCH so that the proper statistics
would be bumped.  So if we change it back, the statistics
will be broken again.

Re: [PATCH] Can not send icmp netunreach packet

[Jarek Poplawski]

On Tue, Feb 26, 2008 at 01:30:30PM -0800, David Miller wrote:
> From: Jarek Poplawski <jarkao2@gmail.com>
> Date: Tue, 26 Feb 2008 07:35:38 +0000
> 
> > On 26-02-2008 07:34, Li Yewang wrote:
> > > Hi All
> > > 
> > >    There is a bug about icmp netunreach.
> > >    If the kernel does not find a route for a packet, 
> > >    it must send a icmp netunreach packet to the source host, 
> > >    and  discard  the packet. But the  kernel  does not send 
> > >    a icmp netunreach packet because of the  fib_lookup
> > >    return value  of -ESRCH when a route  is not found. 
> > 
> > ...or because some function doesn't handle -ESRCH return from
> > fib_lookup? It seems changing this to -ESRCH was needed in some cases.
> > And you don't explain enough why it can't be handled later (like in
> > ipv4/route.c: ip_route_input_slow)?
> 
> This was changed to -ESRCH so that the proper statistics
> would be bumped.  So if we change it back, the statistics
> will be broken again.

Actually, I liked more this sophisticated explanation from the changelog:

http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=83886b6b636173b206f475929e58fac75c6f2446

BTW, it's really hard to find any place which could still behave as
described by Li. Wasn't it with some older kernel?

Jarek P.