From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id CBA0E5A0272 for ; Thu, 21 Dec 2023 07:53:32 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1703141610; bh=pbbOJS/ALnfAon5tisyCIxzqU3+CxuzJ9FMYfNwZZNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L6GtkXarobc7pM4uEZclGkFdniuHWq1JYlt+7VZvK2IfS4Hi07QTEPUhgSvqe3j7+ CX/gKcSMC4Hn5Hpj0eID/zm6KSTN/3Btrb1CL4MS/xIc/kHJOMjuyqKCHdh92EtDEO h1IgGZpine9G/Paxh0sAsWWYd9HyCK+WhSeDWRx8vmDQDtFWce0ZVnRw2GPLFyHe/e QkkvNmPQqvwwuxbbUQ6g20ZCkE9vhKNBo11iaKmeTdH0vN1aFW7zpwnIdLcbpAnDse Ia8dM9ZNzVqOD5spNycqhe8AUoC3svF5edU+3knbljOdQRLH6lojrJ2aCIDL2EouvO 0P+cmn9ZZxu1g== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4Swh3G4bx6z4xS0; Thu, 21 Dec 2023 17:53:30 +1100 (AEDT) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH v2 04/12] icmp: Don't attempt to handle "wrong direction" ping socket traffic Date: Thu, 21 Dec 2023 17:53:19 +1100 Message-ID: <20231221065327.1307827-5-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231221065327.1307827-1-david@gibson.dropbear.id.au> References: <20231221065327.1307827-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: VB6L7U2WHBYISOTRW3FNFP6EGTMPK5OO X-Message-ID-Hash: VB6L7U2WHBYISOTRW3FNFP6EGTMPK5OO X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Linux ICMP "ping" sockets are very specific in what they do. They let userspace send ping requests (ICMP_ECHO or ICMP6_ECHO_REQUEST), and receive matching replies (ICMP_ECHOREPLY or ICMP6_ECHO_REPLY). They don't let you intercept or handle incoming ping requests. In the case of passt/pasta that means we can process echo requests from tap and forward them to a ping socket, then take the replies from the ping socket and forward them to tap. We can't do the reverse: take echo requests from the host and somehow forward them to the guest. There's really no way for something outside to initiate a ping to a passt/pasta connected guest and if there was we'd need an entirely different mechanism to handle it. However, we have some logic to deal with packets going in that reverse direction. Remove it, since it can't ever be used that way. While we're there use defines for the ICMPv6 types, instead of open coded type values. Signed-off-by: David Gibson --- icmp.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/icmp.c b/icmp.c index c745b7b..1f41440 100644 --- a/icmp.c +++ b/icmp.c @@ -93,8 +93,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref) icmp_id_map[V4][id].seq = seq; } - debug("ICMP: echo %s to tap, ID: %i, seq: %i", - (ih->type == ICMP_ECHO) ? "request" : "reply", id, seq); + debug("ICMP: echo reply to tap, ID: %i, seq: %i", id, seq); tap_icmp4_send(c, sr.sin_addr, tap_ip4_daddr(c), buf, n); } @@ -138,8 +137,7 @@ void icmpv6_sock_handler(const struct ctx *c, union epoll_ref ref) icmp_id_map[V6][id].seq = seq; } - debug("ICMPv6: echo %s to tap, ID: %i, seq: %i", - (ih->icmp6_type == 128) ? "request" : "reply", id, seq); + debug("ICMPv6: echo reply to tap, ID: %i, seq: %i", id, seq); tap_icmp6_send(c, &sr.sin6_addr, tap_ip6_daddr(c, &sr.sin6_addr), buf, n); @@ -178,7 +176,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, int af, if (!ih) return 1; - if (ih->type != ICMP_ECHO && ih->type != ICMP_ECHOREPLY) + if (ih->type != ICMP_ECHO) return 1; iref.id = id = ntohs(ih->un.echo.id); @@ -205,8 +203,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, int af, (struct sockaddr *)&sa, sizeof(sa)) < 0) { debug("ICMP: failed to relay request to socket"); } else { - debug("ICMP: echo %s to socket, ID: %i, seq: %i", - (ih->type == ICMP_ECHO) ? "request" : "reply", + debug("ICMP: echo request to socket, ID: %i, seq: %i", id, ntohs(ih->un.echo.sequence)); } } else if (af == AF_INET6) { @@ -222,7 +219,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, int af, if (!ih) return 1; - if (ih->icmp6_type != 128 && ih->icmp6_type != 129) + if (ih->icmp6_type != ICMPV6_ECHO_REQUEST) return 1; iref.id = id = ntohs(ih->icmp6_identifier); @@ -249,8 +246,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, int af, (struct sockaddr *)&sa, sizeof(sa)) < 1) { debug("ICMPv6: failed to relay request to socket"); } else { - debug("ICMPv6: echo %s to socket, ID: %i, seq: %i", - (ih->icmp6_type == 128) ? "request" : "reply", + debug("ICMPv6: echo request to socket, ID: %i, seq: %i", id, ntohs(ih->icmp6_sequence)); } } -- 2.43.0