| From 5a9c2b8c3ce5b685bfa53d4febd7762da9dc3914 Mon Sep 17 00:00:00 2001 |
| From: Sabrina Dubroca <sd@queasysnail.net> |
| Date: Fri, 3 Jul 2020 17:00:32 +0200 |
| Subject: [PATCH] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg |
| |
| commit 5eff06902394425c722f0a44d9545909a8800f79 upstream. |
| |
| IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to |
| incomplete IPsec ACQUIRE messages being sent to userspace. Currently, |
| both raw sockets and IPv6 ping sockets set those fields. |
| |
| Expected output of "ip xfrm monitor": |
| acquire proto esp |
| sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4 |
| policy src 10.0.2.15/32 dst 8.8.8.8/32 |
| <snip> |
| |
| Currently with ping sockets: |
| acquire proto esp |
| sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4 |
| policy src 10.0.2.15/32 dst 8.8.8.8/32 |
| <snip> |
| |
| The Libreswan test suite found this problem after Fedora changed the |
| value for the sysctl net.ipv4.ping_group_range. |
| |
| Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") |
| Reported-by: Paul Wouters <pwouters@redhat.com> |
| Tested-by: Paul Wouters <pwouters@redhat.com> |
| Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c |
| index 9d24ef5c5d8f..ce723a526b73 100644 |
| --- a/net/ipv4/ping.c |
| +++ b/net/ipv4/ping.c |
| @@ -786,6 +786,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) |
| inet_sk_flowi_flags(sk), faddr, saddr, 0, 0, |
| sk->sk_uid); |
| |
| + fl4.fl4_icmp_type = user_icmph.type; |
| + fl4.fl4_icmp_code = user_icmph.code; |
| + |
| security_sk_classify_flow(sk, flowi4_to_flowi(&fl4)); |
| rt = ip_route_output_flow(net, &fl4, sk); |
| if (IS_ERR(rt)) { |
| -- |
| 2.27.0 |
| |