[PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Guillaume Nault]

Ensure the inner IP header is part of the skb's linear data before
setting old_iph. Otherwise, on a fragmented skb, old_iph could point
outside of the packet data.

Use skb_vlan_inet_prepare() on classical VXLAN devices to accommodate
for potential VLANs. Use pskb_inet_may_pull() for VXLAN-GPE as there's
no Ethernet header in that case.

Signed-off-by: Guillaume Nault <gnault@redhat.com>
---
 drivers/net/vxlan/vxlan_core.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index f78dd0438843..323308734192 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2339,7 +2339,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 	struct ip_tunnel_key *pkey;
 	struct ip_tunnel_key key;
 	struct vxlan_dev *vxlan = netdev_priv(dev);
-	const struct iphdr *old_iph = ip_hdr(skb);
+	const struct iphdr *old_iph;
 	struct vxlan_metadata _md;
 	struct vxlan_metadata *md = &_md;
 	unsigned int pkt_len = skb->len;
@@ -2355,6 +2355,16 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 	bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev));
 	__be32 vni = 0;
 
+	if (flags & VXLAN_F_GPE) {
+		if (!pskb_inet_may_pull(skb))
+			goto drop;
+	} else {
+		if (!skb_vlan_inet_prepare(skb))
+			goto drop;
+	}
+
+	old_iph = ip_hdr(skb);
+
 	info = skb_tunnel_info(skb);
 	use_cache = ip_tunnel_dst_cache_usable(skb, info);
 
-- 
2.39.2

Re: [PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Guillaume Nault]

On Wed, May 29, 2024 at 09:01:12PM +0200, Guillaume Nault wrote:
> Ensure the inner IP header is part of the skb's linear data before
> setting old_iph. Otherwise, on a fragmented skb, old_iph could point
> outside of the packet data.

Forgot the Fixes tag. Sorry.

Fixes: d342894c5d2f ("vxlan: virtual extensible lan")

Re: [PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Paolo Abeni]

On Wed, 2024-05-29 at 21:01 +0200, Guillaume Nault wrote:
> Ensure the inner IP header is part of the skb's linear data before
> setting old_iph. Otherwise, on a fragmented skb, old_iph could point
> outside of the packet data.
> 
> Use skb_vlan_inet_prepare() on classical VXLAN devices to accommodate
> for potential VLANs. Use pskb_inet_may_pull() for VXLAN-GPE as there's
> no Ethernet header in that case.

AFAICS even vxlan-GPE allows an ethernet header, see tun_p_to_eth_p()
and:

https://www.ietf.org/archive/id/draft-ietf-nvo3-vxlan-gpe-12.html#name-multi-protocol-support

What I'm missing?

Thanks,

Paolo

Re: [PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Guillaume Nault]

On Tue, Jun 04, 2024 at 12:55:53PM +0200, Paolo Abeni wrote:
> On Wed, 2024-05-29 at 21:01 +0200, Guillaume Nault wrote:
> > Ensure the inner IP header is part of the skb's linear data before
> > setting old_iph. Otherwise, on a fragmented skb, old_iph could point
> > outside of the packet data.
> > 
> > Use skb_vlan_inet_prepare() on classical VXLAN devices to accommodate
> > for potential VLANs. Use pskb_inet_may_pull() for VXLAN-GPE as there's
> > no Ethernet header in that case.
> 
> AFAICS even vxlan-GPE allows an ethernet header, see tun_p_to_eth_p()
> and:
> 
> https://www.ietf.org/archive/id/draft-ietf-nvo3-vxlan-gpe-12.html#name-multi-protocol-support
> 
> What I'm missing?

Didn't see that. I'll post a v2.
Thanks.

> Thanks,
> 
> Paolo
> 

Re: [PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Eric Dumazet]

On Wed, Jun 5, 2024 at 3:38 PM Guillaume Nault <gnault@redhat.com> wrote:
>
> On Tue, Jun 04, 2024 at 12:55:53PM +0200, Paolo Abeni wrote:
> > On Wed, 2024-05-29 at 21:01 +0200, Guillaume Nault wrote:
> > > Ensure the inner IP header is part of the skb's linear data before
> > > setting old_iph. Otherwise, on a fragmented skb, old_iph could point
> > > outside of the packet data.

What is a "fragmented skb" ?

> > >
> > > Use skb_vlan_inet_prepare() on classical VXLAN devices to accommodate
> > > for potential VLANs. Use pskb_inet_may_pull() for VXLAN-GPE as there's
> > > no Ethernet header in that case.
> >
> > AFAICS even vxlan-GPE allows an ethernet header, see tun_p_to_eth_p()
> > and:
> >
> > https://www.ietf.org/archive/id/draft-ietf-nvo3-vxlan-gpe-12.html#name-multi-protocol-support
> >
> > What I'm missing?
>
> Didn't see that. I'll post a v2.
> Thanks.

Also please add a Fixes: tag

Re: [PATCH net] vxlan: Pull inner IP header in vxlan_xmit_one().

[Guillaume Nault]

On Wed, Jun 05, 2024 at 03:49:47PM +0200, Eric Dumazet wrote:
> On Wed, Jun 5, 2024 at 3:38 PM Guillaume Nault <gnault@redhat.com> wrote:
> >
> > On Tue, Jun 04, 2024 at 12:55:53PM +0200, Paolo Abeni wrote:
> > > On Wed, 2024-05-29 at 21:01 +0200, Guillaume Nault wrote:
> > > > Ensure the inner IP header is part of the skb's linear data before
> > > > setting old_iph. Otherwise, on a fragmented skb, old_iph could point
> > > > outside of the packet data.
> 
> What is a "fragmented skb" ?

I meant "non linear". I'll rephrase in v2.

> > > >
> > > > Use skb_vlan_inet_prepare() on classical VXLAN devices to accommodate
> > > > for potential VLANs. Use pskb_inet_may_pull() for VXLAN-GPE as there's
> > > > no Ethernet header in that case.
> > >
> > > AFAICS even vxlan-GPE allows an ethernet header, see tun_p_to_eth_p()
> > > and:
> > >
> > > https://www.ietf.org/archive/id/draft-ietf-nvo3-vxlan-gpe-12.html#name-multi-protocol-support
> > >
> > > What I'm missing?
> >
> > Didn't see that. I'll post a v2.
> > Thanks.
> 
> Also please add a Fixes: tag

Yes, I forgot it in the original posting.
I added it as a reply to the patch email.