netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] ipvlan: add the check of ip header checksum
@ 2020-07-21 13:09 guodeqing
  2020-07-21 19:39 ` Cong Wang
  2020-07-21 22:55 ` David Miller
  0 siblings, 2 replies; 4+ messages in thread
From: guodeqing @ 2020-07-21 13:09 UTC (permalink / raw)
  To: davem; +Cc: kuba, maheshb, edumazet, netdev, geffrey.guo

The ip header checksum can be error in the following steps.
$ ip netns add ns1
$ ip link add gw link eth0 type ipvlan
$ ip addr add 168.16.0.1/24 dev gw
$ ip link set dev gw up
$ ip link add ip1 link eth0 type ipvlan
$ ip link set ip1 netns ns1
$ ip netns exec ns1 ip link set ip1 up
$ ip netns exec ns1 ip addr add 168.16.0.2/24 dev ip1
$ ip netns exec ns1 tc qdisc add dev ip1 root netem corrupt 50%
$ ip netns exec ns1 ping 168.16.0.1

The ip header of a packet maybe modified when it steps in
ipvlan_process_v4_outbound because of the netem, the corruptted
packets should be dropped.

Here I add the check of ip header to drop the corruptted packets
and to avoid a problem in some cases.

Signed-off-by: guodeqing <geffrey.guo@huawei.com>
---
 drivers/net/ipvlan/ipvlan_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 8801d09..22cef89 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -428,6 +428,12 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
 		.saddr = ip4h->saddr,
 	};
 
+	if (ip4h->ihl < 5)
+		goto err;
+
+	if (unlikely(ip_fast_csum((u8 *)ip4h, ip4h->ihl)))
+		goto err;
+
 	rt = ip_route_output_flow(net, &fl4, NULL);
 	if (IS_ERR(rt))
 		goto err;
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-07-22  9:23 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-21 13:09 [PATCH] ipvlan: add the check of ip header checksum guodeqing
2020-07-21 19:39 ` Cong Wang
2020-07-22  9:22   ` 答复: " Guodeqing (A)
2020-07-21 22:55 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).