aboutgitcodebugslistschat
path: root/icmp.h
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2021-07-26 15:26:36 +0200
committerStefano Brivio <sbrivio@redhat.com>2021-07-26 17:43:10 +0200
commit9663378d6d6dcd8275d60b826356cc4be0538231 (patch)
tree510ca04c778d9f03033cd33688da7b58ccb65ce0 /icmp.h
parent0279ec8eaebf0d0ae6d871f44c27db67904b8872 (diff)
downloadpasst-9663378d6d6dcd8275d60b826356cc4be0538231.tar
passt-9663378d6d6dcd8275d60b826356cc4be0538231.tar.gz
passt-9663378d6d6dcd8275d60b826356cc4be0538231.tar.bz2
passt-9663378d6d6dcd8275d60b826356cc4be0538231.tar.lz
passt-9663378d6d6dcd8275d60b826356cc4be0538231.tar.xz
passt-9663378d6d6dcd8275d60b826356cc4be0538231.tar.zst
passt-9663378d6d6dcd8275d60b826356cc4be0538231.zip
icmp: Work around possible failure on bind() due to e.g. broken SELinux policy
If we can't bind() ping sockets, the echo identifier sent out from the socket won't be the original one seen from the tap. Binding a ping socket doesn't require any security capability, but it might still fail due to a broken SELinux policy, see for example: https://bugzilla.redhat.com/show_bug.cgi?id=1848929 Track the ICMP echo identifier as part of the epoll reference for the socket and replace it in the reply on mismatch. We won't send out the original identifier as sent from the guest, but still better than missing replies. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'icmp.h')
-rw-r--r--icmp.h4
1 files changed, 3 insertions, 1 deletions
diff --git a/icmp.h b/icmp.h
index 12547b7..27f0a5c 100644
--- a/icmp.h
+++ b/icmp.h
@@ -15,10 +15,12 @@ void icmp_timer(struct ctx *c, struct timespec *ts);
* union icmp_epoll_ref - epoll reference portion for ICMP tracking
* @v6: Set for IPv6 sockets or connections
* @u32: Opaque u32 value of reference
+ * @id: Associated echo identifier, needed if bind() fails
*/
union icmp_epoll_ref {
struct {
- uint32_t v6:1;
+ uint32_t v6:1,
+ id:16;
};
uint32_t u32;
};