New: MSG_ERRQUEUE messages do not pass to connected raw sockets

Bugme-new In review Andrew Morton 4 participants 5 messages Apr 10, 2008 – Apr 14, 2008 1 message not in the archive

Subsystems (2)

Networking Network drivers

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]/

Andrew Morton

author

2008-04-10 17:35 UTC #1 lore raw

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 65 lines · On Thu, 10 Apr 2008 05:53:39 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10437
           Summary: MSG_ERRQUEUE messages do not pass to connected raw
                    sockets
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.24
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: high
          Priority: P1
         Component: IPV6
        AssignedTo: [email protected]
        ReportedBy: [email protected]
There was a similar bug #8747 , but the fix is not somplete.
Problem Description:
It is related to the possibility to obtain MSG_ERRQUEUE messages from the udp and raw sockets, both connected and unconnected.
There is a bug in net/ipv6/icmp.c code, which prevents such messages to be delivered to the errqueue of the correspond raw socket, when the socket is CONNECTED. The bug is related to wrong obtaining of the saddr/daddr pair, used to find the raw socket.
Consider __raw_v6_lookup() function from net/ipv6/raw.c. When a raw socket is looked up usual way, it is something like:
sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif);
where "daddr" is a destination address of the incoming packet (IOW our local address), "saddr" is a source address of the incoming packet (the remote end).
But when the raw socket is looked up for some icmp error report, in net/ipv6/icmp.c:icmpv6_notify() , daddr/saddr must be obtained from the echoed fragment of the "bad" packet, not from the ipv6 header of the icmp packet itself.
Consider:
ipv6_header -- icmp_header -- echoed_ipv6_header -- at_least_8_bytes ...
Now saddr/daddr, used for __raw_v6_lookup, are from the first "ipv6_header", but must be from the "echoed_ipv6_header" .
In the previous bug #8747, I assumed that the issue is just a typo, by switching saddr/daddr in agrument list. Unfortunately, it appears that the pair is even obtained from the wrong place...
Steps to reproduce:
Create some raw socket, connect it to an address, and cause some error
situation: f.e. set ttl=1 where the remote address is more than 1 hop to reach. Set IPV6_RECVERR .
Then send something and wait for the error (f.e. poll() with POLLERR|POLLIN). You should receive "time exceeded" icmp message (because of "ttl=1"), but the socket do not receive it.

Quoted 4 lines

If you do not connect your raw socket, you will receive MSG_ERRQUEUE successfully. (The reason is that for unconnected socket there are no actual checks for local/remote addresses).

(There's more info, and a patch at the above link).

Dmitry, I'd suggest that you send the patch via email to [email protected] and to YOSHIFUJI Hideaki <[email protected]>.

Dmitry Butskoy

2008-04-11 11:02 UTC #2 lore raw

PATCH 1/1 : bug 10437: MSG_ERRQUEUE messages do not pass to connected raw sockets

Quoted 2 lines · Andrew Morton

Dmitry, I'd suggest that you send the patch via email to [email protected]

OK, resend

Quoted 2 lines

and to YOSHIFUJI Hideaki <[email protected]>.

It seems that I cannot reach this e-mail address from my country :( (some terrible antispam?)

The small patch to fix bug #10437 .

See description of the bug at http://bugzilla.kernel.org/show_bug.cgi?id=10437

Dmitry Butskoy
http://www.fedoraproject.org/wiki/DmitryButskoy

YOSHIFUJI Hideaki / 吉藤英明

2008-04-11 11:10 UTC #3 lore raw

Re: [PATCH] [IPV6]: bug 10437: MSG_ERRQUEUE messages do not pass to connected raw sockets

In article <[email protected]> (at Fri, 11 Apr 2008 15:02:52 +0400), Dmitry Butskoy <[email protected]> says:

Quoted 8 lines

Quoted 2 lines · Andrew Morton
Dmitry, I'd suggest that you send the patch via email to [email protected]
OK, resend
Quoted 2 lines
and to YOSHIFUJI Hideaki <[email protected]>.

Quoted 8 lines

It seems that I cannot reach this e-mail address from my country :( (some terrible antispam?)
The small patch to fix bug #10437 .
See description of the bug at
http://bugzilla.kernel.org/show_bug.cgi?id=10437

I'm going to agree.

Your patch is for 2.6.24-stable
Can you provide patches for linux-2.6.25-rc, please?

Thanks.

--yoshfuji

Dmitry Butskoy

2008-04-11 11:39 UTC #4 lore raw

Re: [PATCH] [IPV6]: bug 10437: MSG_ERRQUEUE messages do not pass to connected raw sockets

Quoted 20 lines · YOSHIFUJI Hideaki / 吉藤英明

In article <[email protected]> (at Fri, 11 Apr 2008 15:02:52 +0400), Dmitry Butskoy <[email protected]> says:
Quoted 17 lines
Quoted 3 lines · Andrew Morton
Dmitry, I'd suggest that you send the patch via email to [email protected]
OK, resend
Quoted 3 lines
and to YOSHIFUJI Hideaki <[email protected]>.
It seems that I cannot reach this e-mail address from my country :( (some terrible antispam?)
The small patch to fix bug #10437 .

Quoted 8 lines

Quoted 2 lines
See description of the bug at http://bugzilla.kernel.org/show_bug.cgi?id=10437
I'm going to agree.
Your patch is for 2.6.24-stable
Can you provide patches for linux-2.6.25-rc, please?

Attached.

Could it be fixed for, say 2.6.24.5, as well?

If it is possible, please, report me at what next stable kernel version it will appear to be fixed...

~buc

raw.c +2 -2

diff -Nrbu ipv6/raw.c ipv6.OK/raw.c
@@ -372,8 +372,8 @@
 	read_lock(&raw_v6_hashinfo.lock);
 	sk = sk_head(&raw_v6_hashinfo.ht[hash]);
 	if (sk != NULL) {
-		saddr = &ipv6_hdr(skb)->saddr;
-		daddr = &ipv6_hdr(skb)->daddr;
+		saddr = &((struct ipv6hdr *)skb->data)->saddr;
+		daddr = &((struct ipv6hdr *)skb->data)->daddr;
 		net = skb->dev->nd_net;
 
 		while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,

David Miller

maintainer

2008-04-14 06:15 UTC #5 lore raw

In reply to Andrew Morton

From: Andrew Morton <[email protected]>
Date: Thu, 10 Apr 2008 10:34:44 -0700

Quoted 2 lines

Dmitry, I'd suggest that you send the patch via email to [email protected] and to YOSHIFUJI Hideaki <[email protected]>.

This person is having trouble emailing things to the lists and elsewhere, for whatever reason, and he states this in the bugzilla entry so asking him to email a patch somewhere isn't going to help.

The code in this area has changed a bit, here is the patch I just checked into net-2.6 and which I'll push to Linus for 2.6.25 and will also submit for the 2.6.24-stable branch.

commit b45e9189c058bfa495073951ff461ee0eea968be

Author: David S. Miller <[email protected]>
Date:   Sun Apr 13 23:14:15 2008 -0700

[IPV6]: Fix ipv6 address fetching in raw6_icmp_error().

Fixes kernel bugzilla 10437

Based almost entirely upon a patch by Dmitry Butskoy.

When deciding what raw sockets to deliver the ICMPv6 to, we should use the addresses in the ICMPv6 quoted IPV6 header, not the top-level one.

Signed-off-by David S. Miller <[email protected]>

net/ipv6/raw.c +4 -2

index 8897ccf..0a6fbc1 100644
@@ -372,8 +372,10 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
 	read_lock(&raw_v6_hashinfo.lock);
 	sk = sk_head(&raw_v6_hashinfo.ht[hash]);
 	if (sk != NULL) {
-		saddr = &ipv6_hdr(skb)->saddr;
-		daddr = &ipv6_hdr(skb)->daddr;
+		struct ipv6hdr *hdr = (struct ipv6hdr *) skb->data;
+
+		saddr = &hdr->saddr;
+		daddr = &hdr->daddr;
 		net = skb->dev->nd_net;
 
 		while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,