mirror of
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git
synced 2024-11-15 22:15:13 +08:00
2f103545a5
Tc pedit action with more than two ip6 munge in a row cause infinite
loop.
Example:
$ tc filter add dev eth0 protocol ipv6 parent ffff: \
flower ip_proto sctp \
action pedit ex \
munge ip6 hoplimit set 0x1 \
munge ip6 src set 2001:0db8:0:f101::1 \
munge that cause infinite loop
The example command never returns, instead of failing with parse error
as expected. Pedit ipv6 structure has wrong id, which leads to the
creation linked list with one node in tc/m_pedit.c:get_pedit_kind(),
referring to itself. This node is created if command have two ip6 munge
in a row, and any third ip6 munge will cause infinite loop.
Changing this id from "ipv6" to "ip6" solves the problem.
Fixes: f3e1b2448a ("pedit: Introduce ipv6 support")
Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
90 lines
1.8 KiB
C
90 lines
1.8 KiB
C
/*
|
|
* p_ip6.c packet editor: IPV6 header
|
|
*
|
|
* This program is free software; you can distribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the License, or (at your option) any later version.
|
|
*
|
|
* Authors: Amir Vadai <amir@vadai.me>
|
|
*
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <fcntl.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <string.h>
|
|
#include "utils.h"
|
|
#include "tc_util.h"
|
|
#include "m_pedit.h"
|
|
|
|
static int
|
|
parse_ip6(int *argc_p, char ***argv_p,
|
|
struct m_pedit_sel *sel, struct m_pedit_key *tkey)
|
|
{
|
|
int res = -1;
|
|
int argc = *argc_p;
|
|
char **argv = *argv_p;
|
|
|
|
if (argc < 2)
|
|
return -1;
|
|
|
|
if (!sel->extended)
|
|
return -1;
|
|
|
|
tkey->htype = TCA_PEDIT_KEY_EX_HDR_TYPE_IP6;
|
|
|
|
if (strcmp(*argv, "src") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 8;
|
|
res = parse_cmd(&argc, &argv, 16, TIPV6, RU32, sel, tkey);
|
|
goto done;
|
|
}
|
|
if (strcmp(*argv, "dst") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 24;
|
|
res = parse_cmd(&argc, &argv, 16, TIPV6, RU32, sel, tkey);
|
|
goto done;
|
|
}
|
|
if (strcmp(*argv, "flow_lbl") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 0;
|
|
res = parse_cmd(&argc, &argv, 4, TU32, 0x0007ffff, sel, tkey);
|
|
goto done;
|
|
}
|
|
if (strcmp(*argv, "payload_len") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 4;
|
|
res = parse_cmd(&argc, &argv, 2, TU32, RU16, sel, tkey);
|
|
goto done;
|
|
}
|
|
if (strcmp(*argv, "nexthdr") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 6;
|
|
res = parse_cmd(&argc, &argv, 1, TU32, RU8, sel, tkey);
|
|
goto done;
|
|
}
|
|
if (strcmp(*argv, "hoplimit") == 0) {
|
|
NEXT_ARG();
|
|
tkey->off = 7;
|
|
res = parse_cmd(&argc, &argv, 1, TU32, RU8, sel, tkey);
|
|
goto done;
|
|
}
|
|
|
|
return -1;
|
|
|
|
done:
|
|
*argc_p = argc;
|
|
*argv_p = argv;
|
|
return res;
|
|
}
|
|
|
|
struct m_pedit_util p_pedit_ip6 = {
|
|
.id = "ip6",
|
|
.parse_peopt = parse_ip6,
|
|
};
|