blob: 09c1b0b8f8eb8074ca24ee89f8323193b01496d4 [file] [log] [blame]
b.liue9582032025-04-17 19:18:16 +08001From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2From: "Jason A. Donenfeld" <Jason@zx2c4.com>
3Date: Thu, 29 Oct 2020 03:56:05 +0100
4Subject: [PATCH] wireguard: selftests: check that route_me_harder packets use
5 the right sk
6
7commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 upstream.
8
9If netfilter changes the packet mark, the packet is rerouted. The
10ip_route_me_harder family of functions fails to use the right sk, opting
11to instead use skb->sk, resulting in a routing loop when used with
12tunnels. With the next change fixing this issue in netfilter, test for
13the relevant condition inside our test suite, since wireguard was where
14the bug was discovered.
15
16Reported-by: Chen Minqiang <ptpt52@gmail.com>
17Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
18Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
19Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
20---
21 tools/testing/selftests/wireguard/netns.sh | 8 ++++++++
22 tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++
23 2 files changed, 10 insertions(+)
24
25--- a/tools/testing/selftests/wireguard/netns.sh
26+++ b/tools/testing/selftests/wireguard/netns.sh
27@@ -316,6 +316,14 @@ pp sleep 3
28 n2 ping -W 1 -c 1 192.168.241.1
29 n1 wg set wg0 peer "$pub2" persistent-keepalive 0
30
31+# Test that sk_bound_dev_if works
32+n1 ping -I wg0 -c 1 -W 1 192.168.241.2
33+# What about when the mark changes and the packet must be rerouted?
34+n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1
35+n1 ping -c 1 -W 1 192.168.241.2 # First the boring case
36+n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case
37+n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1
38+
39 # Test that onion routing works, even when it loops
40 n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5
41 ip1 addr add 192.168.242.1/24 dev wg0
42--- a/tools/testing/selftests/wireguard/qemu/kernel.config
43+++ b/tools/testing/selftests/wireguard/qemu/kernel.config
44@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y
45 CONFIG_NETFILTER_XTABLES=y
46 CONFIG_NETFILTER_XT_NAT=y
47 CONFIG_NETFILTER_XT_MATCH_LENGTH=y
48+CONFIG_NETFILTER_XT_MARK=y
49 CONFIG_NF_CONNTRACK_IPV4=y
50 CONFIG_NF_NAT_IPV4=y
51 CONFIG_IP_NF_IPTABLES=y
52 CONFIG_IP_NF_FILTER=y
53+CONFIG_IP_NF_MANGLE=y
54 CONFIG_IP_NF_NAT=y
55 CONFIG_IP_ADVANCED_ROUTER=y
56 CONFIG_IP_MULTIPLE_TABLES=y