b.liu | e958203 | 2025-04-17 19:18:16 +0800 | [diff] [blame] | 1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | From: "Jason A. Donenfeld" <Jason@zx2c4.com> |
| 3 | Date: Thu, 29 Oct 2020 03:56:05 +0100 |
| 4 | Subject: [PATCH] wireguard: selftests: check that route_me_harder packets use |
| 5 | the right sk |
| 6 | |
| 7 | commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 upstream. |
| 8 | |
| 9 | If netfilter changes the packet mark, the packet is rerouted. The |
| 10 | ip_route_me_harder family of functions fails to use the right sk, opting |
| 11 | to instead use skb->sk, resulting in a routing loop when used with |
| 12 | tunnels. With the next change fixing this issue in netfilter, test for |
| 13 | the relevant condition inside our test suite, since wireguard was where |
| 14 | the bug was discovered. |
| 15 | |
| 16 | Reported-by: Chen Minqiang <ptpt52@gmail.com> |
| 17 | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> |
| 18 | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| 19 | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> |
| 20 | --- |
| 21 | tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ |
| 22 | tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++ |
| 23 | 2 files changed, 10 insertions(+) |
| 24 | |
| 25 | --- a/tools/testing/selftests/wireguard/netns.sh |
| 26 | +++ b/tools/testing/selftests/wireguard/netns.sh |
| 27 | @@ -316,6 +316,14 @@ pp sleep 3 |
| 28 | n2 ping -W 1 -c 1 192.168.241.1 |
| 29 | n1 wg set wg0 peer "$pub2" persistent-keepalive 0 |
| 30 | |
| 31 | +# Test that sk_bound_dev_if works |
| 32 | +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 |
| 33 | +# What about when the mark changes and the packet must be rerouted? |
| 34 | +n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 |
| 35 | +n1 ping -c 1 -W 1 192.168.241.2 # First the boring case |
| 36 | +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case |
| 37 | +n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 |
| 38 | + |
| 39 | # Test that onion routing works, even when it loops |
| 40 | n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 |
| 41 | ip1 addr add 192.168.242.1/24 dev wg0 |
| 42 | --- a/tools/testing/selftests/wireguard/qemu/kernel.config |
| 43 | +++ b/tools/testing/selftests/wireguard/qemu/kernel.config |
| 44 | @@ -18,10 +18,12 @@ CONFIG_NF_NAT=y |
| 45 | CONFIG_NETFILTER_XTABLES=y |
| 46 | CONFIG_NETFILTER_XT_NAT=y |
| 47 | CONFIG_NETFILTER_XT_MATCH_LENGTH=y |
| 48 | +CONFIG_NETFILTER_XT_MARK=y |
| 49 | CONFIG_NF_CONNTRACK_IPV4=y |
| 50 | CONFIG_NF_NAT_IPV4=y |
| 51 | CONFIG_IP_NF_IPTABLES=y |
| 52 | CONFIG_IP_NF_FILTER=y |
| 53 | +CONFIG_IP_NF_MANGLE=y |
| 54 | CONFIG_IP_NF_NAT=y |
| 55 | CONFIG_IP_ADVANCED_ROUTER=y |
| 56 | CONFIG_IP_MULTIPLE_TABLES=y |