mirrors/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2025-05-21 16:55:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

udp: Don't attempt to forward ICMP socket errors to other sockets

Browse source 
Recently we added support for detecting ICMP triggered errors on UDP
sockets and forwarding them to the tap interface.  However, in
udp_sock_recverr() where this is handled we don't know for certain that
the tap interface is the other side of the UDP flow.  It could be a spliced
connection with another socket on the other side.

To forward errors in that case, we'd need to force the other side's socket
to trigger issue an ICMP error.  I'm not sure if there's a way to do that;
probably not for an arbitrary ICMP but it might be possible for certain
error conditions.

Nonetheless what we do now - synthesise an ICMP on the tap interface - is
certainly wrong.  It's probably harmless; for a spliced connection it will
have loopback addresses meaning we can expect the guest to discard it.
But, correct this for now, by not attempting to propagate errors when the
other side of the flow is a socket.

Fixes: 55431f0077 ("udp: create and send ICMPv4 to local peer when applicable")
Fixes: 68b04182e0 ("udp: create and send ICMPv6 to local peer when applicable")
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
David Gibson 2025-03-28 14:34:14 +11:00 • committed by Stefano Brivio
parent 42a854a52b
commit 025a3c2686
1 changed files with 4 additions and 1 deletions

5
udp.c
View file

@ -560,7 +560,10 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref)
const struct flowside *toside = flowside_at_sidx(sidx);
size_t dlen = rc;
if (hdr->cmsg_level == IPPROTO_IP) {
if (pif_is_socket(pif_at_sidx(sidx))) {
/* XXX Is there any way to propagate ICMPs from socket
* to socket? */
} else if (hdr->cmsg_level == IPPROTO_IP) {
dlen = MIN(dlen, ICMP4_MAX_DLEN);
udp_send_conn_fail_icmp4(c, &eh->ee, toside,
eh->saddr.sa4.sin_addr,