bpf_lwt_push_ip_encap() rebases the network header after prepending an outer IP header, but can leave IPCB(skb)->opt describing the inner IPv4 header. An ingress LWT route can then make an ICMP error consume stale option offsets.
Patch 1 marks completed LWT IP encapsulation and clears the stale metadata after bpf_prog_run_save_cb() has restored the protocol control block. For same-family IPv4 encapsulation it clears only IPCB(skb)->opt. For a family change it resets the new family's control block following seg6_do_srh_encap(). Patch 2 adds compact coverage to the existing LWT IP encapsulation selftest. Changes: v4: - Follow Alexei Starovoitov's suggestion to drop the independent freplace patch and keep cb_access as one bit. - Clear only IPv4 options when the family is unchanged; use skb->protocol and the SEG6 precedent when it changes. - Rebase on bpf-next and replace the standalone selftest with compact coverage in the existing LWT IP encapsulation test. v3: https://lore.kernel.org/bpf/[email protected]/ - Follow Daniel Borkmann's suggestion to reset the CB after bpf_prog_run_save_cb() restores it, avoiding an extra CB copy. - Split out freplace handling and selftests, and cover CB access, VRF, nested runs, and already-encapsulated packets. v2: https://lore.kernel.org/bpf/[email protected]/ - Preserve the protocol CB for programs without ctx->cb[] access and restore the proper layout for the final packet consumer. v1: https://lore.kernel.org/bpf/[email protected]/ Weiming Shi (2): bpf: clear stale IPv4 options after LWT encapsulation selftests/bpf: cover stale CB after LWT IP encapsulation include/linux/filter.h | 1 + net/core/lwt_bpf.c | 30 ++++++++++++ .../selftests/bpf/prog_tests/lwt_ip_encap.c | 45 ++++++++++++++++++ .../selftests/bpf/progs/test_lwt_ip_encap.c | 47 +++++++++++++++++++ 4 files changed, 123 insertions(+) -- 2.55.0
