Re: [PATCH 1/2] udp: Don't attempt to forward ICMP socket errors to other sockets

[Jon Maloy <jmaloy@redhat.com>]

On 2025-03-25 20:15, David Gibson wrote:
> Recently we added support for detecting ICMP triggered errors on UDP
> sockets and forwarding them to the tap interface.  However, in
> udp_sock_recverr() where this is handled we don't know for certain that
> the tap interface is the other side of the UDP flow.  It could be a spliced
> connection with another socket on the other side.
> 
> To forward errors in that case, we'd need to force the other side's socket
> to trigger issue an ICMP error.  I'm not sure if there's a way to do that;
> probably not for an arbitrary ICMP but it might be possible for certain
> error conditions.
> 
> Nonetheless what we do now - synthesise an ICMP on the tap interface - is
> certainly wrong.  It's probably harmless; for a spliced connection it will
> have loopback addresses meaning we can expect the guest to discard it.
> But, correct this for now, by not attempting to propagate errors when the
> other side of the flow is a socket.
> 
> Fixes: 55431f007 ("udp: create and send ICMPv4 to local peer when...")
> Fixes: 68b04182e ("udp: create and send ICMPv6 to local peer when...")
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>   udp.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/udp.c b/udp.c
> index 80520cbd..a706fed9 100644
> --- a/udp.c
> +++ b/udp.c
> @@ -559,7 +559,10 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref)
>   		const struct flowside *toside = flowside_at_sidx(sidx);
>   		size_t dlen = rc;
>   
> -		if (hdr->cmsg_level == IPPROTO_IP) {
> +		if (pif_is_socket(pif_at_sidx(sidx))) {
> +			/* XXX Is there any way to propagate ICMPs from socket
> +			 * to socket? */
> +		} else if (hdr->cmsg_level == IPPROTO_IP) {
>   			dlen = MIN(dlen, ICMP4_MAX_DLEN);
>   			udp_send_conn_fail_icmp4(c, ee, toside, saddr.sa4.sin_addr,
>   						 data, dlen);

I never thought about this.  I'll try to think of a solution, if there 
even is any.

In the meantime:

Acked-by: Jon Maloy <jmaloy@redhat.com>