Skip to content

Commit af8afcf

Browse files
zx2c4ummakynes
authored andcommitted
wireguard: selftests: check that route_me_harder packets use the right sk
If netfilter changes the packet mark, the packet is rerouted. The ip_route_me_harder family of functions fails to use the right sk, opting to instead use skb->sk, resulting in a routing loop when used with tunnels. With the next change fixing this issue in netfilter, test for the relevant condition inside our test suite, since wireguard was where the bug was discovered. Reported-by: Chen Minqiang <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent dceabab commit af8afcf

File tree

2 files changed

+10
-0
lines changed

2 files changed

+10
-0
lines changed

tools/testing/selftests/wireguard/netns.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,14 @@ pp sleep 3
316316
n2 ping -W 1 -c 1 192.168.241.1
317317
n1 wg set wg0 peer "$pub2" persistent-keepalive 0
318318

319+
# Test that sk_bound_dev_if works
320+
n1 ping -I wg0 -c 1 -W 1 192.168.241.2
321+
# What about when the mark changes and the packet must be rerouted?
322+
n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1
323+
n1 ping -c 1 -W 1 192.168.241.2 # First the boring case
324+
n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case
325+
n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1
326+
319327
# Test that onion routing works, even when it loops
320328
n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5
321329
ip1 addr add 192.168.242.1/24 dev wg0

tools/testing/selftests/wireguard/qemu/kernel.config

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y
1818
CONFIG_NETFILTER_XTABLES=y
1919
CONFIG_NETFILTER_XT_NAT=y
2020
CONFIG_NETFILTER_XT_MATCH_LENGTH=y
21+
CONFIG_NETFILTER_XT_MARK=y
2122
CONFIG_NF_CONNTRACK_IPV4=y
2223
CONFIG_NF_NAT_IPV4=y
2324
CONFIG_IP_NF_IPTABLES=y
2425
CONFIG_IP_NF_FILTER=y
26+
CONFIG_IP_NF_MANGLE=y
2527
CONFIG_IP_NF_NAT=y
2628
CONFIG_IP_ADVANCED_ROUTER=y
2729
CONFIG_IP_MULTIPLE_TABLES=y

0 commit comments

Comments
 (0)