• Stefano Brivio's avatar
    udp: Handle ICMP errors for tunnels with same destination port on both endpoints · a36e185e
    Stefano Brivio authored
    For both IPv4 and IPv6, if we can't match errors to a socket, try
    tunnels before ignoring them. Look up a socket with the original source
    and destination ports as found in the UDP packet inside the ICMP payload,
    this will work for tunnels that force the same destination port for both
    endpoints, i.e. VXLAN and GENEVE.
    
    Actually, lwtunnels could break this assumption if they are configured by
    an external control plane to have different destination ports on the
    endpoints: in this case, we won't be able to trace ICMP messages back to
    them.
    
    For IPv6 redirect messages, call ip6_redirect() directly with the output
    interface argument set to the interface we received the packet from (as
    it's the very interface we should build the exception on), otherwise the
    new nexthop will be rejected. There's no such need for IPv4.
    
    Tunnels can now export an encap_err_lookup() operation that indicates a
    match. Pass the packet to the lookup function, and if the tunnel driver
    reports a matching association, continue with regular ICMP error handling.
    
    v2:
    - Added newline between network and transport header sets in
      __udp{4,6}_lib_err_encap() (David Miller)
    - Removed redundant skb_reset_network_header(skb); in
      __udp4_lib_err_encap()
    - Removed redundant reassignment of iph in __udp4_lib_err_encap()
      (Sabrina Dubroca)
    - Edited comment to __udp{4,6}_lib_err_encap() to reflect the fact this
      won't work with lwtunnels configured to use asymmetric ports. By the way,
      it's VXLAN, not VxLAN (Jiri Benc)
    Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
    Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a36e185e
udp_tunnel.c 5.42 KB