Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1522820

Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device

Show all headers | View raw

On 11/15/16 7:45 AM, Hannes Frederic Sowa wrote:

>> @@ -1012,6 +1013,16 @@ static int ip6_dst_lookup_tail(struct net *net,
>> const struct sock *sk,
>>          }
>>  #endif
>>
>> +        addr_type = ipv6_addr_type(&fl6->saddr);
>> +        if (addr_type == IPv6_ADDR_ANY)
>> +                return 0;
>> +
>> +        err = -EINVAL;
>> +        bind_to_dev = __ipv6_addr_src_scope(addr_type) <=
>> IPV6_ADDR_SCOPE_LINKLOCAL;
>> +        if (!ipv6_chk_addr(net, &fl6->saddr, bind_to_dev ?
>> (*dst)->dev : NULL, 0) &&
>> +            !ipv6_chk_acast_addr_src(net, (*dst)->dev, &fl6->saddr))
>> +                goto out_err_release;
>> +
>>          return 0;
>>
>>  out_err_release:
>>
> 
> We should not use (*dst)->dev, as this is the resulting device after the
> lookup and not necessarily corresponds to the device the user asked for.

To be consistent with IPv4 the saddr check is done before the lookup and dst and flow oif should not be used. Handling LL addresses are trickier and perhaps this is not the right place to enforce that check since it requires a specific device which is only really known after lookup. Why not add the if saddr is LL verification as part of the route selection? e.g, add something like rt6_device_match to ip6_pol_route (the device match call is only used for ip6_pol_route_lookup and not ip6_pol_route - why is that?).

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Source address fib invalidation on IPv6 David Ahern <dsa@cumulusnetworks.com> - 2016-11-11 23:30 +0100
  Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 03:20 +0100
    Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 16:50 +0100
      Re: Source address fib invalidation on IPv6 David Ahern <dsa@cumulusnetworks.com> - 2016-11-12 19:20 +0100
        Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 20:10 +0100
          Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 01:50 +0100
            Re: Source address fib invalidation on IPv6 Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-13 02:00 +0100
              Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 02:10 +0100
                [PATCH] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 14:40 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 17:40 +0100
                [PATCH v2] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 20:10 +0100
                Re: [PATCH v2] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 21:50 +0100
                [PATCH v3] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-14 00:30 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 17:20 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 17:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:00 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 18:10 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:20 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 18:40 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 19:40 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-15 01:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-15 15:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-15 16:30 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 21:30 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 21:40 +0100
            Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 02:00 +0100

csiph-web