On Sat, Jun 27, 2020 at 1:58 AM Jason A. Donenfeld <ja...@zx2c4.com> wrote: > > Hi again Hans, > > A few remarks: although gre implements header_ops, it looks like > various parts of the networking stack change behavior based on it. I'm > still analyzing that to understand the extent of the effects. > Something like > <https://git.zx2c4.com/wireguard-linux/commit/?id=40c24fd379edc1668087111506ed3d0928052fe0> > would work, but I'm not thrilled by it. Further research is needed. > > However, one thing I noticed is that other layer 3 tunnels don't seem > to be a fan of libpcap. For example, try injecting a packet into an > ipip interface. You'll hit exactly the same snag for skb->protocol==0.
Not setting skb protocol when sending over packet sockets causes many headaches. Besides packet_parse_headers, virtio_net_hdr_to_skb also tries to infer it. Packet sockets give various options to configure it explicitly: by choosing that protocol in socket(), bind() or, preferably, by passing it as argument to sendmsg. The socket/bind argument also configures the filter to receive packets, so for send-only sockets it is especially useful to choose ETH_P_NONE (0) there. This is not an "incorrect" option. Libpcap does have a pcap_set_protocol function, but it is fairly recent, so few processes will likely be using it. And again it is still not ideal if a socket is opened only for transmit. header_ops looks like the best approach to me, too. The protocol field needs to reflect the protocol of the *outer* packet, of course, but if I read wg_allowedips_lookup_dst correctly, wireguard maintains the same outer protocol as the inner protocol, no sit (6-in-4) and such.
