48 lines
1.6 KiB
Diff
48 lines
1.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
|
|
Date: Mon, 22 Feb 2021 17:25:47 +0100
|
|
Subject: [PATCH] wireguard: device: do not generate ICMP for non-IP packets
|
|
|
|
commit 99fff5264e7ab06f45b0ad60243475be0a8d0559 upstream.
|
|
|
|
If skb->protocol doesn't match the actual skb->data header, it's
|
|
probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
|
|
expecting to reply to a valid IP packet. So this commit has that early
|
|
mismatch case jump to a later error label.
|
|
|
|
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
---
|
|
drivers/net/wireguard/device.c | 7 ++++---
|
|
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
|
--- a/drivers/net/wireguard/device.c
|
|
+++ b/drivers/net/wireguard/device.c
|
|
@@ -138,7 +138,7 @@ static netdev_tx_t wg_xmit(struct sk_buf
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
|
net_dbg_ratelimited("%s: No peer has allowed IPs matching %pI6\n",
|
|
dev->name, &ipv6_hdr(skb)->daddr);
|
|
- goto err;
|
|
+ goto err_icmp;
|
|
}
|
|
|
|
family = READ_ONCE(peer->endpoint.addr.sa_family);
|
|
@@ -201,12 +201,13 @@ static netdev_tx_t wg_xmit(struct sk_buf
|
|
|
|
err_peer:
|
|
wg_peer_put(peer);
|
|
-err:
|
|
- ++dev->stats.tx_errors;
|
|
+err_icmp:
|
|
if (skb->protocol == htons(ETH_P_IP))
|
|
icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
|
icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
|
|
+err:
|
|
+ ++dev->stats.tx_errors;
|
|
kfree_skb(skb);
|
|
return ret;
|
|
}
|