FAILED: patch "[PATCH] ipv{4,6}/raw: fix output xfrm lookup wrt protocol" failed to apply to 5.4-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 3632679d9e4f879f49949bb5b050e0de553e4739
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2023052635-styling-unbutton-ac91@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
3632679d9e4f ("ipv{4,6}/raw: fix output xfrm lookup wrt protocol") 91d0b78c5177 ("inet: Add IP_LOCAL_PORT_RANGE socket option") 28044fc1d495 ("net: Add a bhash2 table hashed by port and address") d2c135619cb8 ("inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()") ca7af0402550 ("tcp: add small random increments to the source port") ffa84b5ffb37 ("net: add netns refcount tracker to struct sock") 938cca9e4109 ("sock: fix /proc/net/sockstat underflow in sk_clone_lock()") 990c74e3f41d ("memcg: enable accounting for inet_bin_bucket cache") 333bb73f620e ("tcp: Keep TCP_CLOSE sockets in the reuseport group.") 5c040eaf5d17 ("tcp: Add num_closed_socks to struct sock_reuseport.") c579bd1b4021 ("tcp: add some entropy in __inet_hash_connect()") 190cc82489f4 ("tcp: change source port randomizarion at connect() time") bbc20b70424a ("net: reduce indentation level in sk_clone_lock()") 62ffc589abb1 ("net: refactor bind_bucket fastreuse into helper") 47ec5303d73e ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3632679d9e4f879f49949bb5b050e0de553e4739 Mon Sep 17 00:00:00 2001
From: Nicolas Dichtel <[email protected]>
Date: Mon, 22 May 2023 14:08:20 +0200
Subject: [PATCH] ipv{4,6}/raw: fix output xfrm lookup wrt protocol
With a raw socket bound to IPPROTO_RAW (ie with hdrincl enabled), the protocol field of the flow structure, build by raw_sendmsg() / rawv6_sendmsg()), is set to IPPROTO_RAW. This breaks the ipsec policy lookup when some policies are defined with a protocol in the selector.
For ipv6, the sin6_port field from 'struct sockaddr_in6' could be used to specify the protocol. Just accept all values for IPPROTO_RAW socket.
For ipv4, the sin_port field of 'struct sockaddr_in' could not be used without breaking backward compatibility (the value of this field was never checked). Let's add a new kind of control message, so that the userland could specify which protocol is used.
include/net/ip.h +2 -0
@@ -76,6 +76,7 @@ struct ipcm_cookie {__be32 addr;int oif;struct ip_options_rcu *opt; +__u8 protocol;__u8 ttl;__s16 tos;char priority;
@@ -96,6 +97,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm, ipcm->sockc.tsflags = inet->sk.sk_tsflags; ipcm->oif =READ_ONCE (inet->sk.sk_bound_dev_if); ipcm->addr = inet->inet_saddr; + ipcm->protocol = inet->inet_num; }#define IPCB (skb) ((struct inet_skb_parm*)((skb)->cb))
include/uapi/linux/in.h +1 -0
@@ -163,6 +163,7 @@ struct in_addr {#define IP_MULTICAST_ALL 49#define IP_UNICAST_IF 50#define IP_LOCAL_PORT_RANGE 51 +#define IP_PROTOCOL 52#define MCAST_EXCLUDE 0#define MCAST_INCLUDE 1
net/ipv4/ip_sockglue.c +11 -1
@@ -317,7 +317,14 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc, ipc->tos = val; ipc->priority =rt_tos2priority (ipc->tos);break ; - +case IP_PROTOCOL : +if (cmsg->cmsg_len !=CMSG_LEN (sizeof (int ))) +return -EINVAL ; + val = *(int *)CMSG_DATA (cmsg); +if (val <1 || val >255 ) +return -EINVAL ; + ipc->protocol = val; +break ;default :return -EINVAL ; }
@@ -1761,6 +1768,9 @@ int do_ip_getsockopt(struct sock *sk, int level, int optname,case IP_LOCAL_PORT_RANGE : val = inet->local_port_range.hi <<16 | inet->local_port_range.lo;break ; +case IP_PROTOCOL : + val =inet_sk (sk)->inet_num; +break ;default :sockopt_release_sock (sk);return -ENOPROTOOPT ;
net/ipv4/raw.c +4 -1
@@ -532,6 +532,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) }ipcm_init_sk (&ipc, inet); +/* Keep backward compat */ +if (hdrincl) + ipc.protocol =IPPROTO_RAW ;if (msg->msg_controllen) { err =ip_cmsg_send (sk, msg, &ipc, false);
@@ -599,7 +602,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)flowi4_init_output (&fl4, ipc.oif, ipc.sockc.mark, tos,RT_SCOPE_UNIVERSE , - hdrincl ?IPPROTO_RAW : sk->sk_protocol, + hdrincl ? ipc.protocol : sk->sk_protocol,inet_sk_flowi_flags (sk) | (hdrincl ?FLOWI_FLAG_KNOWN_NH :0 ), daddr, saddr,0 ,0 , sk->sk_uid);
net/ipv6/raw.c +2 -1
@@ -793,7 +793,8 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)if (!proto) proto = inet->inet_num; -else if (proto != inet->inet_num) +else if (proto != inet->inet_num && + inet->inet_num !=IPPROTO_RAW )return -EINVAL ;if (proto >255 )