Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device

From	David Ahern <dsa@cumulusnetworks.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device
Date	2016-11-14 17:20 +0100
Message-ID	<sDs9b-RG-5@gated-at.bofh.it> (permalink)
References	<sD9SV-5kR-17@gated-at.bofh.it> <sDcnM-73M-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 11/13/16 4:28 PM, Jason A. Donenfeld wrote:
> This puts the IPv6 routing functions in parity with the IPv4 routing
> functions. Namely, we now check in v6 that if a flowi6 requests an
> saddr, the returned dst actually corresponds to a net device that has
> that saddr. This mirrors the v4 logic with __ip_dev_find in
> __ip_route_output_key_hash. In the event that the returned dst is not
> for a dst with a dev that has the saddr, we return -EINVAL, just like
> v4; this makes it easy to use the same error handlers for both cases.
> 
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> Cc: David Ahern <dsa@cumulusnetworks.com>
> ---
> Changes from v2:
>     It turns out ipv6_chk_addr already has the device enumeration
>     logic that we need by simply passing NULL.
> 
>  net/ipv6/ip6_output.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 6001e78..b3b5cb6 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -926,6 +926,10 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
>  	int err;
>  	int flags = 0;
>  
> +	if (!ipv6_addr_any(&fl6->saddr) &&
> +	    !ipv6_chk_addr(net, &fl6->saddr, NULL, 1))
> +		return -EINVAL;
> +
>  	/* The correct way to handle this would be to do
>  	 * ip6_route_get_saddr, and then ip6_route_output; however,
>  	 * the route-specific preferred source forces the
> 

LGTM

Acked-by: David Ahern <dsa@cumulusnetworks.com>

Thread

Re: Source address fib invalidation on IPv6 David Ahern <dsa@cumulusnetworks.com> - 2016-11-11 23:30 +0100
  Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 03:20 +0100
    Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 16:50 +0100
      Re: Source address fib invalidation on IPv6 David Ahern <dsa@cumulusnetworks.com> - 2016-11-12 19:20 +0100
        Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-12 20:10 +0100
          Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 01:50 +0100
            Re: Source address fib invalidation on IPv6 Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-13 02:00 +0100
              Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 02:10 +0100
                [PATCH] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 14:40 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 17:40 +0100
                [PATCH v2] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 20:10 +0100
                Re: [PATCH v2] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 21:50 +0100
                [PATCH v3] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-14 00:30 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 17:20 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 17:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:00 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 18:10 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:20 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 18:40 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-14 18:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-14 19:40 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-15 01:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-11-15 15:50 +0100
                Re: [PATCH v3] ip6_output: ensure flow saddr actually belongs to  device David Ahern <dsa@cumulusnetworks.com> - 2016-11-15 16:30 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 21:30 +0100
                Re: [PATCH] ip6_output: ensure flow saddr actually belongs to device David Ahern <dsa@cumulusnetworks.com> - 2016-11-13 21:40 +0100
            Re: Source address fib invalidation on IPv6 "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-11-13 02:00 +0100

csiph-web