[Devel] [PATCH vz10 1/7] ms/vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

[Devel] [PATCH vz10 1/7] ms/vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

[Eva Kurchatova]

From: Eric Dumazet <edumazet@google.com>

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
and drivers/net/geneve.c.

Found by Sashiko.

Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Link: https://patch.msgid.link/20260525203642.2389723-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf)

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix ms/net
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 drivers/net/vxlan/vxlan_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 7c9d2450209a..700bee7e7733 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2554,7 +2554,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 			goto out_unlock;
 		}
 
-		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+		tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb);
 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
 		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
 				      vni, md, flags, udp_sum);
@@ -2623,7 +2623,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 			goto out_unlock;
 		}
 
-		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+		tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb);
 		ttl = ttl ? : ip6_dst_hoplimit(ndst);
 		skb_scrub_packet(skb, xnet);
 		err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 2/7] selftests: net: run the fdb and bind tests in their own netns

[Eva Kurchatova]

Three tests share the initial namespace with the machine and fail on
what is already in it.

fdb_notify and test_vxlan_fdb_changelink bring up a vxlan device on the
default port 4789. Where the machine already has one there, and that
one is metadata based, as the device open vswitch keeps is, the port
cannot be shared and the test device is never created:

  # ip link add vxs type vxlan external dstport 4789
  # ip link add name vx up type vxlan id 2000 dstport 4789
  RTNETLINK answers: Address already in use
  # ./test_vxlan_fdb_changelink.sh
  Cannot find device "vx"
  expected two remotes after link set	[FAIL]

Run both in a fresh namespace by re-executing them there, the way
nft_audit.sh, nft_concat_range.sh and br_netfilter_queue.sh already do.

bind_wildcard binds 0.0.0.0 and expects to know which sockets exist.
With 432 foreign sockets on 0.0.0.0 on the machine it failed 6 runs out
of 10; unsharing a namespace in FIXTURE_SETUP took that to 0 out of 10.
This is what commit a897e194c475 ("selftests: net: run reuseport in an
isolated netns") does for the reuseport tests.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/bind_wildcard.c         | 13 +++++++++++++
 tools/testing/selftests/net/fdb_notify.sh           |  7 +++++++
 .../selftests/net/test_vxlan_fdb_changelink.sh      |  7 +++++++
 3 files changed, 27 insertions(+)

diff --git a/tools/testing/selftests/net/bind_wildcard.c b/tools/testing/selftests/net/bind_wildcard.c
index b7b54d646b93..5ebf21c97df1 100644
--- a/tools/testing/selftests/net/bind_wildcard.c
+++ b/tools/testing/selftests/net/bind_wildcard.c
@@ -1,6 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright Amazon.com Inc. or its affiliates. */
 
+#define _GNU_SOURCE
+#include <sched.h>
+
+#include <stdlib.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 
@@ -716,6 +720,15 @@ static void setup_addr(FIXTURE_DATA(bind_wildcard) *self, int i,
 
 FIXTURE_SETUP(bind_wildcard)
 {
+	/* The port is picked by the kernel and the test then expects every
+	 * conflict on it to be one it caused itself.  A socket the rest of
+	 * the system holds on that port breaks that: a v6only bind to ::
+	 * is given a port whose 0.0.0.0 counterpart is taken, and the
+	 * binds that follow fail with EADDRINUSE the test does not expect.
+	 */
+	ASSERT_EQ(unshare(CLONE_NEWNET), 0);
+	ASSERT_EQ(system("ip link set lo up"), 0);
+
 	setup_addr(self, 0, variant->family[0], variant->addr[0]);
 	setup_addr(self, 1, variant->family[1], variant->addr[1]);
 
diff --git a/tools/testing/selftests/net/fdb_notify.sh b/tools/testing/selftests/net/fdb_notify.sh
index c159230c9b62..4f65f6720b1b 100755
--- a/tools/testing/selftests/net/fdb_notify.sh
+++ b/tools/testing/selftests/net/fdb_notify.sh
@@ -1,6 +1,13 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+# The test brings up a vxlan device on the default port, which fails where
+# the host already has one, as a metadata-based device holding that port is
+# not compatible with the one the test asks for:
+#   RTNETLINK answers: Address already in use
+# Run in a fresh network namespace, like the netfilter tests do.
+[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
+
 source lib.sh
 
 ALL_TESTS="
diff --git a/tools/testing/selftests/net/test_vxlan_fdb_changelink.sh b/tools/testing/selftests/net/test_vxlan_fdb_changelink.sh
index 2d442cdab11e..7319bbcc4fbc 100755
--- a/tools/testing/selftests/net/test_vxlan_fdb_changelink.sh
+++ b/tools/testing/selftests/net/test_vxlan_fdb_changelink.sh
@@ -3,6 +3,13 @@
 
 # Check FDB default-remote handling across "ip link set".
 
+# The test brings up a vxlan device on the default port, which fails where
+# the host already has one, as a metadata-based device holding that port is
+# not compatible with the one the test asks for:
+#   RTNETLINK answers: Address already in use
+# Run in a fresh network namespace, like the netfilter tests do.
+[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
+
 check_remotes()
 {
 	local what=$1; shift
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 3/7] selftests: net: skip what this kernel and iproute2 do not have

[Eva Kurchatova]

Five cases report a failure where a feature is simply not there.

tls asks for every cipher it knows and fails on the ones the kernel does
not implement, SM4 and ARIA, which answer ENOENT at setsockopt
time. Skip a cipher the kernel refuses that way; the run then reports
632 passed, 264 skipped and none failed.

rtnetlink.sh sets up an erspan tunnel, which this kernel does not have
and which fails with "Unknown device type", and checks a netconf dump
whose exit status iproute2 gets wrong: 6.11 exits 2 on a dump that
worked, 6.17 exits 0. Probe for both and skip when unusable.

rtnetlink.py asks for an IPv4 multicast address dump the kernel answers
with EOPNOTSUPP, and ip_local_port_range asks for protocols it does not
have. Skip those too.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../selftests/net/ip_local_port_range.c       | 17 +++++++---
 tools/testing/selftests/net/rtnetlink.py      | 11 +++++--
 tools/testing/selftests/net/rtnetlink.sh      | 31 +++++++++++++++++++
 tools/testing/selftests/net/tls.c             |  2 ++
 4 files changed, 55 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/net/ip_local_port_range.c b/tools/testing/selftests/net/ip_local_port_range.c
index 29451d2244b7..2d7b9c852b2b 100644
--- a/tools/testing/selftests/net/ip_local_port_range.c
+++ b/tools/testing/selftests/net/ip_local_port_range.c
@@ -118,10 +118,6 @@ static int get_ip_local_port_range(int fd, __u32 *range)
 
 FIXTURE(ip_local_port_range) {};
 
-FIXTURE_SETUP(ip_local_port_range)
-{
-}
-
 FIXTURE_TEARDOWN(ip_local_port_range)
 {
 }
@@ -180,6 +176,19 @@ FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_mptcp) {
 	.so_protocol	= IPPROTO_MPTCP,
 };
 
+FIXTURE_SETUP(ip_local_port_range)
+{
+	int fd;
+
+	/* Not every protocol under test is built into every kernel. */
+	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
+	if (fd < 0 && (errno == EPROTONOSUPPORT || errno == ESOCKTNOSUPPORT ||
+		       errno == EAFNOSUPPORT))
+		SKIP(return, "%s", strerror(errno));
+	ASSERT_GE(fd, 0) TH_LOG("socket failed");
+	close(fd);
+}
+
 TEST_F(ip_local_port_range, invalid_option_value)
 {
 	__u16 val16;
diff --git a/tools/testing/selftests/net/rtnetlink.py b/tools/testing/selftests/net/rtnetlink.py
index baa7b33f313e..425fc7a3941b 100755
--- a/tools/testing/selftests/net/rtnetlink.py
+++ b/tools/testing/selftests/net/rtnetlink.py
@@ -1,7 +1,9 @@
 #! /usr/bin/python3 -sP
 # SPDX-License-Identifier: GPL-2.0
 
-from lib.py import ksft_exit, ksft_run, ksft_ge, RtnlAddrFamily
+from lib.py import ksft_exit, ksft_run, ksft_ge, KsftSkipEx
+from lib.py import NlError, RtnlAddrFamily
+import errno
 import socket
 
 IPV4_ALL_HOSTS_MULTICAST = b'\xe0\x00\x00\x01'
@@ -12,7 +14,12 @@ def dump_mcaddr_check(rtnl: RtnlAddrFamily) -> None:
     At least the loopback interface should have this address.
     """
 
-    addresses = rtnl.getmulticast({"ifa-family": socket.AF_INET}, dump=True)
+    try:
+        addresses = rtnl.getmulticast({"ifa-family": socket.AF_INET}, dump=True)
+    except NlError as e:
+        if e.nl_msg.error == -errno.EOPNOTSUPP:
+            raise KsftSkipEx("IPv4 multicast address dump is not supported")
+        raise
 
     all_host_multicasts = [
         addr for addr in addresses if addr['multicast'] == IPV4_ALL_HOSTS_MULTICAST
diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
index 5f72b447e940..cc4e94b90002 100755
--- a/tools/testing/selftests/net/rtnetlink.sh
+++ b/tools/testing/selftests/net/rtnetlink.sh
@@ -142,10 +142,30 @@ kci_del_dummy()
 	run_cmd ip link del dev "$devdummy"
 }
 
+# Some iproute2 versions exit non-zero from a netconf dump that worked,
+# printing the devconf and then failing anyway.  Nothing about the kernel
+# can be learned from the exit status of such an ip, so find out once.
+netconf_exit_status_usable()
+{
+	local out
+
+	out=$(ip -4 netconf show dev lo 2>/dev/null)
+	if [ $? -ne 0 ] && [ -n "$out" ]; then
+		return 1
+	fi
+	return 0
+}
+
 kci_test_netconf()
 {
 	dev="$1"
 	r=$ret
+
+	if ! netconf_exit_status_usable; then
+		end_test "SKIP: ip netconf $dev: iproute2 fails a dump that worked"
+		return $ksft_skip
+	fi
+
 	run_cmd ip netconf show dev "$dev"
 	for f in 4 6; do
 		run_cmd ip -$f netconf show dev "$dev"
@@ -920,6 +940,17 @@ kci_test_erspan()
 		return $ksft_skip
 	fi
 
+	# the kernel can be built without erspan, rtnetlink then has no ops
+	# for the type and says so.  A kernel that has it gets past this and
+	# fails on the attributes the probe leaves out.
+	if ip -netns "$testns" link add dev "$DEV_NS" type erspan 2>&1 | \
+	   grep -q "Unknown device type"; then
+		end_test "SKIP: erspan: not supported by the kernel"
+		ip netns del "$testns"
+		return $ksft_skip
+	fi
+	ip -netns "$testns" link del dev "$DEV_NS" 2>/dev/null
+
 	# test native tunnel erspan v1
 	run_cmd ip -netns "$testns" link add dev "$DEV_NS" type erspan seq \
 		key 102 local 172.16.1.100 remote 172.16.1.200 \
diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
index c9b0b4337e12..07f2b454d755 100644
--- a/tools/testing/selftests/net/tls.c
+++ b/tools/testing/selftests/net/tls.c
@@ -413,6 +413,8 @@ FIXTURE_SETUP(tls)
 		return;
 
 	ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
+	if (ret < 0 && errno == ENOENT)
+		SKIP(return, "Cipher not built into the kernel");
 	ASSERT_EQ(ret, 0);
 
 	ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len);
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 4/7] selftests: net: make the veth GRO checks independent of host tunnels

[Eva Kurchatova]

Three aggregation checks report 10 packets where they want 1 on a host
that has a vxlan, and pass on a host that does not. The kernel is doing
what it is written to do.

udp4_gro_receive() looks up the receiving socket only when
udp_encap_needed_key is on, and that key is global: any UDP
encapsulation socket on the machine, in any namespace, turns it on.
udp_gro_receive() then aggregates for a packet that has no socket, or
for a socket that asked for UDP GRO, and consults NETIF_F_GRO_UDP_FWD
only in the first case. So with a vxlan somewhere on the box the lookup
finds the test's own receiver, and rx-udp-gro-forwarding never gets a
say.

Ask for UDP GRO on the receiving socket, which makes the aggregation
happen either way. Where no encapsulation socket exists the lookup
still does not happen and the device flag still decides, so what the
checks cover there does not change.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/veth.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/veth.sh b/tools/testing/selftests/net/veth.sh
index 6bb7dfaa30b6..b95167f0b4c2 100755
--- a/tools/testing/selftests/net/veth.sh
+++ b/tools/testing/selftests/net/veth.sh
@@ -105,7 +105,15 @@ chk_gro() {
 	NSTAT_HISTORY=$STATS ip netns exec $NS_DST nstat -n
 
 	printf "%-60s" "$msg"
-	ip netns exec $BASE$DST ./udpgso_bench_rx -C 1000 -R 10 &
+	# -G makes the receiving socket ask for UDP GRO.  Without it the
+	# aggregation checks depend on no UDP encapsulation socket existing
+	# anywhere on the machine: udp4_gro_receive() only looks up the
+	# socket when udp_encap_needed_key is on, and that key is global.
+	# With a vxlan on the host the lookup finds this receiver, and
+	# NETIF_F_GRO_UDP_FWD is then not consulted at all, so nothing is
+	# aggregated.  On a machine without such a socket the lookup does
+	# not happen and the device flag still decides, as before.
+	ip netns exec $BASE$DST ./udpgso_bench_rx -G -C 1000 -R 10 &
 	local spid=$!
 	sleep 0.1
 
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 5/7] selftests: net: install pmtu.sh, the script pmtu_wrapper.sh runs

[Eva Kurchatova]

pmtu_wrapper.sh is a test program and does nothing but run pmtu.sh in a
namespace, yet pmtu.sh is in no install list, so an installed testsuite
has the wrapper without the script it needs:

  exec of "./pmtu.sh" failed: No such file or directory

Add it to TEST_FILES.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 745fd2248b07..fa0173413ce5 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -110,6 +110,7 @@ TEST_GEN_FILES += $(YNL_GEN_FILES)
 
 TEST_FILES := settings
 TEST_FILES += in_netns.sh lib.sh net_helper.sh setup_loopback.sh setup_veth.sh
+TEST_FILES += pmtu.sh
 
 TEST_GEN_FILES += $(patsubst %.c,%.o,$(wildcard *.bpf.c))
 
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 6/7] selftests: net: mark test_ingress_egress_chaining.sh executable

[Eva Kurchatova]

The script is listed in TEST_PROGS but, alone among the tests in that
directory, is not executable. The runner copes: it falls back to the
interpreter named in the shebang, so the test does run, and the only
trace is a line in the log

  # Warning: file test_ingress_egress_chaining.sh is not executable

Anything that runs the script itself, rather than through the runner,
needs the bit. Set it.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/test_ingress_egress_chaining.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 tools/testing/selftests/net/test_ingress_egress_chaining.sh

diff --git a/tools/testing/selftests/net/test_ingress_egress_chaining.sh b/tools/testing/selftests/net/test_ingress_egress_chaining.sh
old mode 100644
new mode 100755
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH vz10 7/7] selftests: net: let the bridged PMTU tests take the ICMP they ask for

[Eva Kurchatova]

The bridged tunnel PMTU tests send a packet that is too big to make the
tunnel answer with "Frag needed", which is how the route exception they
check gets created. The ping that does it from the namespace holding
the bridge is given a deadline, and ping(8) says of it:

  In this case ping does not stop after count packet are sent, it waits
  either for deadline expire or until count probes are answered or for
  some error notification from network.

so it stops at that very ICMP and reports the loss:

  # ping -M want -i 0.1 -w 1 -s 4500 192.168.2.2
  From 192.168.2.2 icmp_seq=2 Frag needed and DF set (mtu = 3950)
  2 packets transmitted, 0 received, +1 errors, 100% packet loss

  TEST: IPv4, bridged vxlan4: PMTU exceptions                    [FAIL]

The exception is created all the same, and with the right value, the
test never gets to look at it. Ask for a count of pings instead, as
the line above this one already does for the other namespace, so the
error is counted and the run goes on.

All 16 bridged cases pass with this, vxlan and geneve, over IPv4 and
IPv6.

https://virtuozzo.atlassian.net/browse/VSTOR-139651
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 tools/testing/selftests/net/pmtu.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
index 6c651c880fe8..d607429840cf 100755
--- a/tools/testing/selftests/net/pmtu.sh
+++ b/tools/testing/selftests/net/pmtu.sh
@@ -1409,7 +1409,12 @@ test_pmtu_ipvX_over_bridged_vxlanY_or_geneveY_exception() {
 	mtu "${ns_b}" ${type}_b $((${ll_mtu} + 1000))
 
 	run_cmd ${ns_c} ${ping} -q -M want -i 0.1 -c 10 -s $((${ll_mtu} + 500)) ${dst} || return 1
-	run_cmd ${ns_a} ${ping} -q -M want -i 0.1 -w 1  -s $((${ll_mtu} + 500)) ${dst} || return 1
+	# This ping is meant to draw the ICMP that creates the exception,
+	# and ping stops on "some error notification from network" where a
+	# deadline is given, see ping(8), so it would always report the
+	# loss and fail here.  Send a count of them instead, as the ping
+	# above does.
+	run_cmd ${ns_a} ${ping} -q -M want -i 0.1 -c 10 -s $((${ll_mtu} + 500)) ${dst} || return 1
 
 	# Check that exceptions were created
 	pmtu="$(route_get_dst_pmtu_from_exception "${ns_c}" ${dst})"
-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel