Skip to content

Commit

Permalink
Merge branch 'vrf-fix-source-address-selection-with-route-leak'
Browse files Browse the repository at this point in the history
Nicolas Dichtel says:

====================
vrf: fix source address selection with route leak

For patch 1 and 2, I didn't find the exact commit that introduced this bug, but
I suspect it has been here since the first version. I arbitrarily choose one.
====================

Link: https://patch.msgid.link/20240710081521.3809742-1-nicolas.dichtel@6wind.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  • Loading branch information
Jakub Kicinski committed Jul 14, 2024
2 parents f67a90a + 3936718 commit d657f5c
Show file tree
Hide file tree
Showing 6 changed files with 120 additions and 12 deletions.
20 changes: 14 additions & 6 deletions include/net/ip6_route.h
Original file line number Diff line number Diff line change
Expand Up @@ -127,18 +127,26 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,

static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
const struct in6_addr *daddr,
unsigned int prefs,
unsigned int prefs, int l3mdev_index,
struct in6_addr *saddr)
{
struct net_device *l3mdev;
struct net_device *dev;
bool same_vrf;
int err = 0;

if (f6i && f6i->fib6_prefsrc.plen) {
rcu_read_lock();

l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev)
dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
*saddr = f6i->fib6_prefsrc.addr;
} else {
struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
else
err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);

err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
}
rcu_read_unlock();

return err;
}
Expand Down
13 changes: 11 additions & 2 deletions net/ipv4/fib_semantics.c
Original file line number Diff line number Diff line change
Expand Up @@ -2270,6 +2270,15 @@ void fib_select_path(struct net *net, struct fib_result *res,
fib_select_default(fl4, res);

check_saddr:
if (!fl4->saddr)
fl4->saddr = fib_result_prefsrc(net, res);
if (!fl4->saddr) {
struct net_device *l3mdev;

l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);

if (!l3mdev ||
l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev)
fl4->saddr = fib_result_prefsrc(net, res);
else
fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK);
}
}
3 changes: 2 additions & 1 deletion net/ipv6/addrconf.c
Original file line number Diff line number Diff line change
Expand Up @@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
master, &dst,
scores, hiscore_idx);

if (scores[hiscore_idx].ifa)
if (scores[hiscore_idx].ifa &&
scores[hiscore_idx].scopedist >= 0)
goto out;
}

Expand Down
1 change: 1 addition & 0 deletions net/ipv6/ip6_output.c
Original file line number Diff line number Diff line change
Expand Up @@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
from = rt ? rcu_dereference(rt->from) : NULL;
err = ip6_route_get_saddr(net, from, &fl6->daddr,
sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
fl6->flowi6_l3mdev,
&fl6->saddr);
rcu_read_unlock();

Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/route.c
Original file line number Diff line number Diff line change
Expand Up @@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
goto nla_put_failure;
} else if (dest) {
struct in6_addr saddr_buf;
if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 &&
if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&
nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
goto nla_put_failure;
}
Expand Down
93 changes: 91 additions & 2 deletions tools/testing/selftests/net/vrf_route_leaking.sh
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
# while it is forwarded between different vrfs.

source lib.sh
PATH=$PWD:$PWD/tools/testing/selftests/net:$PATH
VERBOSE=0
PAUSE_ON_FAIL=no
DEFAULT_TTYPE=sym
Expand Down Expand Up @@ -533,6 +534,86 @@ ipv6_ping_frag_asym()
ipv6_ping_frag asym
}

ipv4_ping_local()
{
log_section "IPv4 (sym route): VRF ICMP local error route lookup ping"

setup_sym

check_connectivity || return

run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP}
log_test $? 0 "VRF ICMP local IPv4"
}

ipv4_tcp_local()
{
log_section "IPv4 (sym route): VRF tcp local connection"

setup_sym

check_connectivity || return

run_cmd nettest -s -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &
sleep 1
run_cmd nettest -N "$r1" -d blue -r ${H2_N2_IP}
log_test $? 0 "VRF tcp local connection IPv4"
}

ipv4_udp_local()
{
log_section "IPv4 (sym route): VRF udp local connection"

setup_sym

check_connectivity || return

run_cmd nettest -s -D -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 &
sleep 1
run_cmd nettest -D -N "$r1" -d blue -r ${H2_N2_IP}
log_test $? 0 "VRF udp local connection IPv4"
}

ipv6_ping_local()
{
log_section "IPv6 (sym route): VRF ICMP local error route lookup ping"

setup_sym

check_connectivity6 || return

run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6}
log_test $? 0 "VRF ICMP local IPv6"
}

ipv6_tcp_local()
{
log_section "IPv6 (sym route): VRF tcp local connection"

setup_sym

check_connectivity6 || return

run_cmd nettest -s -6 -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &
sleep 1
run_cmd nettest -6 -N "$r1" -d blue -r ${H2_N2_IP6}
log_test $? 0 "VRF tcp local connection IPv6"
}

ipv6_udp_local()
{
log_section "IPv6 (sym route): VRF udp local connection"

setup_sym

check_connectivity6 || return

run_cmd nettest -s -6 -D -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 &
sleep 1
run_cmd nettest -6 -D -N "$r1" -d blue -r ${H2_N2_IP6}
log_test $? 0 "VRF udp local connection IPv6"
}

################################################################################
# usage

Expand All @@ -555,8 +636,10 @@ EOF
# Some systems don't have a ping6 binary anymore
command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)

TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym"
TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym"
TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_tcp_local
ipv4_udp_local ipv4_ping_ttl_asym ipv4_traceroute_asym"
TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_tcp_local ipv6_udp_local
ipv6_ping_ttl_asym ipv6_traceroute_asym"

ret=0
nsuccess=0
Expand Down Expand Up @@ -594,12 +677,18 @@ do
ipv4_traceroute|traceroute) ipv4_traceroute;;&
ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&
ipv4_ping_frag|ping) ipv4_ping_frag;;&
ipv4_ping_local|ping) ipv4_ping_local;;&
ipv4_tcp_local) ipv4_tcp_local;;&
ipv4_udp_local) ipv4_udp_local;;&

ipv6_ping_ttl|ping) ipv6_ping_ttl;;&
ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;&
ipv6_traceroute|traceroute) ipv6_traceroute;;&
ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&
ipv6_ping_frag|ping) ipv6_ping_frag;;&
ipv6_ping_local|ping) ipv6_ping_local;;&
ipv6_tcp_local) ipv6_tcp_local;;&
ipv6_udp_local) ipv6_udp_local;;&

# setup namespaces and config, but do not run any tests
setup_sym|setup) setup_sym; exit 0;;
Expand Down

0 comments on commit d657f5c

Please sign in to comment.