mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 09:59:32 +00:00
Merge tag 'ipvs-for-v4.10' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs-next
Simon Horman says: ==================== IPVS Updates for v4.10 please consider these enhancements to the IPVS for v4.10. * Decrement the IP ttl in all the modes in order to prevent infinite route loops. Thanks to Dwip Banerjee. * Use IS_ERR_OR_NULL macro. Clean-up from Gao Feng. ==================== Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
commit
f6b3ef5e38
2 changed files with 55 additions and 1 deletions
|
@ -3260,7 +3260,7 @@ static int ip_vs_genl_dump_dests(struct sk_buff *skb,
|
|||
|
||||
|
||||
svc = ip_vs_genl_find_service(ipvs, attrs[IPVS_CMD_ATTR_SERVICE]);
|
||||
if (IS_ERR(svc) || svc == NULL)
|
||||
if (IS_ERR_OR_NULL(svc))
|
||||
goto out_err;
|
||||
|
||||
/* Dump the destinations */
|
||||
|
|
|
@ -254,6 +254,54 @@ static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af,
|
|||
return true;
|
||||
}
|
||||
|
||||
static inline bool decrement_ttl(struct netns_ipvs *ipvs,
|
||||
int skb_af,
|
||||
struct sk_buff *skb)
|
||||
{
|
||||
struct net *net = ipvs->net;
|
||||
|
||||
#ifdef CONFIG_IP_VS_IPV6
|
||||
if (skb_af == AF_INET6) {
|
||||
struct dst_entry *dst = skb_dst(skb);
|
||||
|
||||
/* check and decrement ttl */
|
||||
if (ipv6_hdr(skb)->hop_limit <= 1) {
|
||||
/* Force OUTPUT device used as source address */
|
||||
skb->dev = dst->dev;
|
||||
icmpv6_send(skb, ICMPV6_TIME_EXCEED,
|
||||
ICMPV6_EXC_HOPLIMIT, 0);
|
||||
__IP6_INC_STATS(net, ip6_dst_idev(dst),
|
||||
IPSTATS_MIB_INHDRERRORS);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/* don't propagate ttl change to cloned packets */
|
||||
if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
|
||||
return false;
|
||||
|
||||
ipv6_hdr(skb)->hop_limit--;
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
if (ip_hdr(skb)->ttl <= 1) {
|
||||
/* Tell the sender its packet died... */
|
||||
__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
|
||||
icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
|
||||
return false;
|
||||
}
|
||||
|
||||
/* don't propagate ttl change to cloned packets */
|
||||
if (!skb_make_writable(skb, sizeof(struct iphdr)))
|
||||
return false;
|
||||
|
||||
/* Decrease ttl */
|
||||
ip_decrease_ttl(ip_hdr(skb));
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Get route to destination or remote server */
|
||||
static int
|
||||
__ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,
|
||||
|
@ -326,6 +374,9 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,
|
|||
return local;
|
||||
}
|
||||
|
||||
if (!decrement_ttl(ipvs, skb_af, skb))
|
||||
goto err_put;
|
||||
|
||||
if (likely(!(rt_mode & IP_VS_RT_MODE_TUNNEL))) {
|
||||
mtu = dst_mtu(&rt->dst);
|
||||
} else {
|
||||
|
@ -473,6 +524,9 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,
|
|||
return local;
|
||||
}
|
||||
|
||||
if (!decrement_ttl(ipvs, skb_af, skb))
|
||||
goto err_put;
|
||||
|
||||
/* MTU checking */
|
||||
if (likely(!(rt_mode & IP_VS_RT_MODE_TUNNEL)))
|
||||
mtu = dst_mtu(&rt->dst);
|
||||
|
|
Loading…
Reference in a new issue