Commit 99fff526 authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Jakub Kicinski
Browse files

wireguard: device: do not generate ICMP for non-IP packets 



If skb->protocol doesn't match the actual skb->data header, it's
probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
expecting to reply to a valid IP packet. So this commit has that early
mismatch case jump to a later error label.

Fixes: e7096c13 ("net: WireGuard secure network tunnel")
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5a059869

drivers/net/wireguard/device.c

+4 −3
Original line number Diff line number Diff line
@@ -138,7 +138,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) 
		else if (skb->protocol == htons(ETH_P_IPV6))

			net_dbg_ratelimited("%s: No peer has allowed IPs matching %pI6\n",

					    dev->name, &ipv6_hdr(skb)->daddr);

		goto err;

		goto err_icmp;

	}



	family = READ_ONCE(peer->endpoint.addr.sa_family);
@@ -201,12 +201,13 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) 


err_peer:

	wg_peer_put(peer);

err:

	++dev->stats.tx_errors;

err_icmp:

	if (skb->protocol == htons(ETH_P_IP))

		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);

	else if (skb->protocol == htons(ETH_P_IPV6))

		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);

err:

	++dev->stats.tx_errors;

	kfree_skb(skb);

	return ret;

}