* [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk [not found] <20201110035318.423757-1-sashal@kernel.org> @ 2020-11-10 3:52 ` Sasha Levin 2020-11-10 12:29 ` Jason A. Donenfeld 0 siblings, 1 reply; 4+ messages in thread From: Sasha Levin @ 2020-11-10 3:52 UTC (permalink / raw) To: linux-kernel, stable Cc: Jason A. Donenfeld, Chen Minqiang, Pablo Neira Ayuso, Sasha Levin, wireguard, netdev, linux-kselftest From: "Jason A. Donenfeld" <Jason@zx2c4.com> [ Upstream commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 ] If netfilter changes the packet mark, the packet is rerouted. The ip_route_me_harder family of functions fails to use the right sk, opting to instead use skb->sk, resulting in a routing loop when used with tunnels. With the next change fixing this issue in netfilter, test for the relevant condition inside our test suite, since wireguard was where the bug was discovered. Reported-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++ 2 files changed, 10 insertions(+) diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh index d77f4829f1e07..74c69b75f6f5a 100755 --- a/tools/testing/selftests/wireguard/netns.sh +++ b/tools/testing/selftests/wireguard/netns.sh @@ -316,6 +316,14 @@ pp sleep 3 n2 ping -W 1 -c 1 192.168.241.1 n1 wg set wg0 peer "$pub2" persistent-keepalive 0 +# Test that sk_bound_dev_if works +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 +# What about when the mark changes and the packet must be rerouted? +n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 +n1 ping -c 1 -W 1 192.168.241.2 # First the boring case +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case +n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 + # Test that onion routing works, even when it loops n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 ip1 addr add 192.168.242.1/24 dev wg0 diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config index d531de13c95b0..4eecb432a66c1 100644 --- a/tools/testing/selftests/wireguard/qemu/kernel.config +++ b/tools/testing/selftests/wireguard/qemu/kernel.config @@ -18,10 +18,12 @@ CONFIG_NF_NAT=y CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MARK=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_NAT_IPV4=y CONFIG_IP_NF_IPTABLES=y CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_MANGLE=y CONFIG_IP_NF_NAT=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_MULTIPLE_TABLES=y -- 2.27.0 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk 2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk Sasha Levin @ 2020-11-10 12:29 ` Jason A. Donenfeld 2020-11-10 17:21 ` Greg KH 0 siblings, 1 reply; 4+ messages in thread From: Jason A. Donenfeld @ 2020-11-10 12:29 UTC (permalink / raw) To: Sasha Levin Cc: LKML, stable, Chen Minqiang, Pablo Neira Ayuso, WireGuard mailing list, Netdev, linux-kselftest Note that this requires https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8 And that commit should be backported to every kernel ever, since the bug is so old. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk 2020-11-10 12:29 ` Jason A. Donenfeld @ 2020-11-10 17:21 ` Greg KH 2020-11-13 22:40 ` Jason A. Donenfeld 0 siblings, 1 reply; 4+ messages in thread From: Greg KH @ 2020-11-10 17:21 UTC (permalink / raw) To: Jason A. Donenfeld Cc: Sasha Levin, LKML, stable, Chen Minqiang, Pablo Neira Ayuso, WireGuard mailing list, Netdev, linux-kselftest On Tue, Nov 10, 2020 at 01:29:41PM +0100, Jason A. Donenfeld wrote: > Note that this requires > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8 > And that commit should be backported to every kernel ever, since the > bug is so old. Sasha queued this up to 5.4.y and 5.9.y, but it looks like it doesn't easily apply to older kernels. If you think that it's needed beyond that, I'll gladly take backported patches. thanks, greg k-h ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk 2020-11-10 17:21 ` Greg KH @ 2020-11-13 22:40 ` Jason A. Donenfeld 0 siblings, 0 replies; 4+ messages in thread From: Jason A. Donenfeld @ 2020-11-13 22:40 UTC (permalink / raw) To: Greg KH Cc: Sasha Levin, LKML, stable, Chen Minqiang, Pablo Neira Ayuso, WireGuard mailing list, Netdev, linux-kselftest On Tue, Nov 10, 2020 at 6:20 PM Greg KH <greg@kroah.com> wrote: > > On Tue, Nov 10, 2020 at 01:29:41PM +0100, Jason A. Donenfeld wrote: > > Note that this requires > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8 > > And that commit should be backported to every kernel ever, since the > > bug is so old. > > Sasha queued this up to 5.4.y and 5.9.y, but it looks like it doesn't > easily apply to older kernels. If you think that it's needed beyond > that, I'll gladly take backported patches. Backport to older kernels coming your way shortly. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-11-13 22:41 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <20201110035318.423757-1-sashal@kernel.org> 2020-11-10 3:52 ` [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk Sasha Levin 2020-11-10 12:29 ` Jason A. Donenfeld 2020-11-10 17:21 ` Greg KH 2020-11-13 22:40 ` Jason A. Donenfeld
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).