Development discussion of WireGuard
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk
       [not found] <20201110035318.423757-1-sashal@kernel.org>
@ 2020-11-10  3:52 ` Sasha Levin
  2020-11-10 12:29   ` Jason A. Donenfeld
  0 siblings, 1 reply; 4+ messages in thread
From: Sasha Levin @ 2020-11-10  3:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Jason A. Donenfeld, Chen Minqiang, Pablo Neira Ayuso,
	Sasha Levin, wireguard, netdev, linux-kselftest

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

[ Upstream commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 ]

If netfilter changes the packet mark, the packet is rerouted. The
ip_route_me_harder family of functions fails to use the right sk, opting
to instead use skb->sk, resulting in a routing loop when used with
tunnels. With the next change fixing this issue in netfilter, test for
the relevant condition inside our test suite, since wireguard was where
the bug was discovered.

Reported-by: Chen Minqiang <ptpt52@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/wireguard/netns.sh           | 8 ++++++++
 tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh
index d77f4829f1e07..74c69b75f6f5a 100755
--- a/tools/testing/selftests/wireguard/netns.sh
+++ b/tools/testing/selftests/wireguard/netns.sh
@@ -316,6 +316,14 @@ pp sleep 3
 n2 ping -W 1 -c 1 192.168.241.1
 n1 wg set wg0 peer "$pub2" persistent-keepalive 0
 
+# Test that sk_bound_dev_if works
+n1 ping -I wg0 -c 1 -W 1 192.168.241.2
+# What about when the mark changes and the packet must be rerouted?
+n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1
+n1 ping -c 1 -W 1 192.168.241.2 # First the boring case
+n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case
+n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1
+
 # Test that onion routing works, even when it loops
 n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5
 ip1 addr add 192.168.242.1/24 dev wg0
diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config
index d531de13c95b0..4eecb432a66c1 100644
--- a/tools/testing/selftests/wireguard/qemu/kernel.config
+++ b/tools/testing/selftests/wireguard/qemu/kernel.config
@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y
 CONFIG_NETFILTER_XTABLES=y
 CONFIG_NETFILTER_XT_NAT=y
 CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MARK=y
 CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_NF_NAT_IPV4=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_MANGLE=y
 CONFIG_IP_NF_NAT=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
-- 
2.27.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk
  2020-11-10  3:52 ` [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk Sasha Levin
@ 2020-11-10 12:29   ` Jason A. Donenfeld
  2020-11-10 17:21     ` Greg KH
  0 siblings, 1 reply; 4+ messages in thread
From: Jason A. Donenfeld @ 2020-11-10 12:29 UTC (permalink / raw)
  To: Sasha Levin
  Cc: LKML, stable, Chen Minqiang, Pablo Neira Ayuso,
	WireGuard mailing list, Netdev, linux-kselftest

Note that this requires
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8
And that commit should be backported to every kernel ever, since the
bug is so old.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk
  2020-11-10 12:29   ` Jason A. Donenfeld
@ 2020-11-10 17:21     ` Greg KH
  2020-11-13 22:40       ` Jason A. Donenfeld
  0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2020-11-10 17:21 UTC (permalink / raw)
  To: Jason A. Donenfeld
  Cc: Sasha Levin, LKML, stable, Chen Minqiang, Pablo Neira Ayuso,
	WireGuard mailing list, Netdev, linux-kselftest

On Tue, Nov 10, 2020 at 01:29:41PM +0100, Jason A. Donenfeld wrote:
> Note that this requires
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8
> And that commit should be backported to every kernel ever, since the
> bug is so old.

Sasha queued this up to 5.4.y and 5.9.y, but it looks like it doesn't
easily apply to older kernels.  If you think that it's needed beyond
that, I'll gladly take backported patches.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk
  2020-11-10 17:21     ` Greg KH
@ 2020-11-13 22:40       ` Jason A. Donenfeld
  0 siblings, 0 replies; 4+ messages in thread
From: Jason A. Donenfeld @ 2020-11-13 22:40 UTC (permalink / raw)
  To: Greg KH
  Cc: Sasha Levin, LKML, stable, Chen Minqiang, Pablo Neira Ayuso,
	WireGuard mailing list, Netdev, linux-kselftest

On Tue, Nov 10, 2020 at 6:20 PM Greg KH <greg@kroah.com> wrote:
>
> On Tue, Nov 10, 2020 at 01:29:41PM +0100, Jason A. Donenfeld wrote:
> > Note that this requires
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=46d6c5ae953cc0be38efd0e469284df7c4328cf8
> > And that commit should be backported to every kernel ever, since the
> > bug is so old.
>
> Sasha queued this up to 5.4.y and 5.9.y, but it looks like it doesn't
> easily apply to older kernels.  If you think that it's needed beyond
> that, I'll gladly take backported patches.

Backport to older kernels coming your way shortly.

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-11-13 22:41 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20201110035318.423757-1-sashal@kernel.org>
2020-11-10  3:52 ` [PATCH AUTOSEL 5.9 26/55] wireguard: selftests: check that route_me_harder packets use the right sk Sasha Levin
2020-11-10 12:29   ` Jason A. Donenfeld
2020-11-10 17:21     ` Greg KH
2020-11-13 22:40       ` Jason A. Donenfeld

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/wireguard

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 wireguard wireguard/ http://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git