[Swan-dev] icmp acquire
Paul Wouters
paul at nohats.ca
Fri Jun 19 12:22:19 UTC 2020
The following patch is needed for newer kernels to fix the icmp
acquire kernel bug. Thanks to Sabrina for hunting this one down.
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 535427292194..df6fbefe44d4 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -786,6 +786,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
inet_sk_flowi_flags(sk), faddr, saddr, 0, 0,
sk->sk_uid);
+ fl4.fl4_icmp_type = user_icmph.type;
+ fl4.fl4_icmp_code = user_icmph.code;
+
security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
rt = ip_route_output_flow(net, &fl4, sk);
if (IS_ERR(rt)) {
note that I worked around this by:
testing/guestbin/swan-prep:subprocess.getoutput('sudo sysctl net.ipv4.ping_group_range="1 65535"')
So we will be able to remove that workaround in the future again.
Paul
More information about the Swan-dev
mailing list