diff options
| author | Jason A. Donenfeld <Jason@zx2c4.com> | 2021-02-22 17:25:47 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-02-23 15:59:34 -0800 |
| commit | 05a909421f659b1bba4f26716ef2248f6c611a67 (patch) | |
| tree | 569e1884a195b3b1ca1aba0851f299cc182f53ac | |
| parent | 4a0e2188a72aa502fa7b338ff18b8b49ebe05e9d (diff) | |
| download | wireguard-linux-trimmed-05a909421f659b1bba4f26716ef2248f6c611a67.tar.gz wireguard-linux-trimmed-05a909421f659b1bba4f26716ef2248f6c611a67.zip | |
wireguard: device: do not generate ICMP for non-IP packets
If skb->protocol doesn't match the actual skb->data header, it's
probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
expecting to reply to a valid IP packet. So this commit has that early
mismatch case jump to a later error label.
Fixes: a8f1bc7bdea3 ("net: WireGuard secure network tunnel")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/wireguard/device.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c index cd51a2a..8502e1b 100644 --- a/drivers/net/wireguard/device.c +++ b/drivers/net/wireguard/device.c @@ -138,7 +138,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) else if (skb->protocol == htons(ETH_P_IPV6)) net_dbg_ratelimited("%s: No peer has allowed IPs matching %pI6\n", dev->name, &ipv6_hdr(skb)->daddr); - goto err; + goto err_icmp; } family = READ_ONCE(peer->endpoint.addr.sa_family); @@ -201,12 +201,13 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) err_peer: wg_peer_put(peer); -err: - ++dev->stats.tx_errors; +err_icmp: if (skb->protocol == htons(ETH_P_IP)) icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); else if (skb->protocol == htons(ETH_P_IPV6)) icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0); +err: + ++dev->stats.tx_errors; kfree_skb(skb); return ret; } |