On 11/11/2024 00:54, Sergey Ryazanov wrote:
Another one forgotten question, sorry about this. Please find the
question inlined.
On 29.10.2024 12:47, Antonio Quartulli wrote:
/* Send user data to the network
*/
netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)
{
+ struct ovpn_struct *ovpn = netdev_priv(dev);
+ struct sk_buff *segments, *curr, *next;
+ struct sk_buff_head skb_list;
+ __be16 proto;
+ int ret;
+
+ /* reset netfilter state */
+ nf_reset_ct(skb);
+
+ /* verify IP header size in network packet */
+ proto = ovpn_ip_check_protocol(skb);
+ if (unlikely(!proto || skb->protocol != proto)) {
+ net_err_ratelimited("%s: dropping malformed payload packet\n",
+ dev->name);
+ dev_core_stats_tx_dropped_inc(ovpn->dev);
+ goto drop;
+ }
The above check implies that kernel can feed a network device with skb-
>protocol value mismatches actual skb content. Can you share any
example of such case?
If you just want to be sure that the user packet is either IPv4 or IPv6
then it can be done like this and without error messages:
/* Support only IPv4 or IPv6 traffic transporting */
if (unlikely(skb->protocol == ETH_P_IP || skb->protocol == ETH_P_IPV6))
goto drop;
It look good, but I will still increase the drop counter, because
something entered the interface and we are trashing it.
Why not printing a message? The interface is not Ethernet based, so I
think we should not expect anything else other than v4 or v6, no?
Thanks.
Regards,
--
Antonio Quartulli
OpenVPN Inc.
