iproute2 parser vor ip6gre interface configuration

From: AnnaIv <hidden>
Date: 2026-08-26 15:51:19

Hello, I noticed something that can be considered as a bug and not a
vulnerability. When I try to up interface with this line in
configuration file:

pre-up ip tunnel add mgre0 mode ip6gre key 1 ttl 64 tos inherit/c0

it cannot be parsed as it is already parsed in ipv4 gre tunnel. I
checked file link_gre6.c function gre_parse_opt. It says that
parameter inherit/number cannot be parsed as two. On page
https://man7.org/linux/man-pages/man8/ip-tunnel.8.html there is a
paragraph:

tclass T
                     set the type of service (IPv4) or traffic class
                     (IPv6) field on tunneled packets, which can be
                     specified as either a two-digit hex value (e.g. c0)
                     or a predefined string (e.g. internet).  The value
                     inherit causes the field to be copied from the
                     original IP header. The values inherit/STRING or
                     inherit/00..ff will set the field to STRING or
                     00..ff when tunneling non-IP packets. The default
                     value is 00.

I consider this as statement that for IPv4 and IPv6 it must be parsed
identically. Please, could you fix this issue?

I know that in Linux ip6_gre.c function prepare_ip6gre_xmit_other for,
as I think, sending non-ip parameter flags has higher priority than
flowinfo. It can be considered as a reason not to change parser. But I
think that it also can be fixed with a small patch. I will suggest
this patch to Linux project or at least fix it just for me.

In any case I ask you to consider this issue because it contradicts
the paragraph from linux man-pages.

I suppose that without patch you don't accept my issue so I decided to
make it by myself
Replace:
 else if (!matches(*argv, "tos") ||
               !matches(*argv, "tclass") ||
               !matches(*argv, "dsfield")) {
            __u8 uval;

            NEXT_ARG();
            flowinfo &= ~IP6_FLOWINFO_TCLASS;
            if (strcmp(*argv, "inherit") == 0)
                flags |= IP6_TNL_F_USE_ORIG_TCLASS;
            else {
                if (get_u8(&uval, *argv, 16))
                    invarg("invalid TClass", *argv);
                flowinfo |= htonl((__u32)uval << 20) & IP6_FLOWINFO_TCLASS;
                flags &= ~IP6_TNL_F_USE_ORIG_TCLASS;
            }
        }
With:
else if (!matches(*argv, "tos") ||
               !matches(*argv, "tclass") ||
               !matches(*argv, "dsfield")) {
            static const char inherit_str[] = "inherit";
            const size_t inherit_len = sizeof(inherit_str) - 1;
            __u8 uval;

            NEXT_ARG();

            flowinfo &= ~IP6_FLOWINFO_TCLASS;

            if (strncmp(*argv, inherit_str, inherit_len) == 0 &&
                (*argv)[inherit_len] == '/') {
                char *val = *argv + inherit_len + 1;

                if (get_u8(&uval, val, 16))
                    invarg("invalid TClass", *argv);

                flowinfo |= htonl((__u32)uval << 20) & IP6_FLOWINFO_TCLASS;
                flags |= IP6_TNL_F_USE_ORIG_TCLASS;
            } else if (strcmp(*argv, inherit_str) == 0) {
                flags |= IP6_TNL_F_USE_ORIG_TCLASS;
            } else {
                if (get_u8(&uval, *argv, 16))
                    invarg("invalid TClass", *argv);

                flowinfo |= htonl((__u32)uval << 20) & IP6_FLOWINFO_TCLASS;
                flags &= ~IP6_TNL_F_USE_ORIG_TCLASS;
            }
        }

so it can parse inherit/number type of argument. Please, consider my fix

Sincerely, Anna
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help