From: David Ahern <dsa@cumulusnetworks.com>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Netdev <netdev@vger.kernel.org>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
LKML <linux-kernel@vger.kernel.org>,
WireGuard mailing list <wireguard@lists.zx2c4.com>,
YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Subject: Re: [WireGuard] Source address fib invalidation on IPv6
Date: Sat, 12 Nov 2016 11:14:01 -0700 [thread overview]
Message-ID: <0dbf5deb-bffb-4878-a268-1adb17c47676@cumulusnetworks.com> (raw)
In-Reply-To: <CAHmME9oeAuBQJguTFivYsYw4fMoc4+sgxcdS4MArN474m7NjTQ@mail.gmail.com>
On 11/12/16 8:40 AM, Jason A. Donenfeld wrote:
> Hi again,
>
> I've done some pretty in depth debugging now to determine exactly what
> the behavior of ipv6_stub->ipv6_dst_lookup is. First I'll start with
> ip_route_output_flow, which I believe to be well behaved, and then
> I'll show ipv6_stub->ipv6_dst_lookup, which seems ill-behaved:
>
> Userspace:
> ip addr add 192.168.1.2/24 dev eth0
> Kernelspace:
> struct flowi4 fl = {
> .saddr = 192.168.1.2,
> .daddr = 192.168.1.99,
> };
> rt = ip_route_output_flow(sock_net(sock), &fl, sock);
> // rt returns valid rt for routing to 192.168.1.99 from
> 192.168.1.2 using eth0
> Userspace:
> ip addr add 192.168.1.3/24 dev eth0
> ip addr del 192.168.1.2/24 dev eth0
> Kernelspace:
> struct flowi4 fl = {
> .saddr = 192.168.1.2,
> .daddr = 192.168.1.99,
> };
> rt = ip_route_output_flow(sock_net(sock), &fl, sock);
> // PTR_ERR(rt) == -EINVAL
I believe that is coming from __ip_route_output_key_hash(), line 2232 with __ip_dev_find not finding a device with that address.
Not applicable for your use case, but __ip_dev_find does not have any checks on which L3 domain the device belongs to so the check does not handle VRF for example. I'll take a look at fixing this next week.
>
> This seems correct behavior to me, since no interface has 192.168.1.2
> as a source address.
>
> Now for the incorrect IPv6 behavior:
>
> Userspace:
> ip -6 addr add abcd::2/96 dev eth0
> Kernelspace:
> struct flowi6 fl = {
> .saddr = abcd::2,
> .daddr = abcd::99,
> };
> ret = ipv6_stub->ipv6_dst_lookup(sock_net(sock), sock, &dst, &fl);
> // ret is 0, and dst is a non-null dst routing to abcd::99 from
> abcd::2 using eth0
> Userspace:
> ip -6 addr add abcd::3/96 dev eth0
> ip -6 addr del abcd::2/96 dev eth0
> Kernelspace:
> struct flowi6 fl = {
> .saddr = abcd::2,
> .daddr = abcd::99,
> };
> ret = ipv6_stub->ipv6_dst_lookup(sock_net(sock), sock, &dst, &fl);
> // ret is 0, and dst is a non-null dst routing to abcd::99 from
> abcd::2 using eth0 **INCORRECT BEHAVIOR!**
>
> This seems *INCORRECT* behavior to me, since no interface has abcd::2
> as a source address.
Gotcha. I don't see any checks that the saddr is valid similar to what IPv4 does.
I think the right place to add a check is in ip6_dst_lookup_tail():
if (!ipv6_addr_any(&fl6->saddr)) {
// saddr is valid for L3 domain
}
next prev parent reply other threads:[~2016-11-12 18:11 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-11 19:29 Jason A. Donenfeld
2016-11-11 22:14 ` David Ahern
2016-11-12 2:18 ` Jason A. Donenfeld
2016-11-12 15:40 ` Jason A. Donenfeld
2016-11-12 18:14 ` David Ahern [this message]
2016-11-12 19:08 ` Jason A. Donenfeld
2016-11-13 0:43 ` Jason A. Donenfeld
2016-11-13 0:51 ` Hannes Frederic Sowa
2016-11-13 1:00 ` Jason A. Donenfeld
2016-11-13 13:23 ` [WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device Jason A. Donenfeld
2016-11-13 16:30 ` David Ahern
2016-11-13 19:02 ` [WireGuard] [PATCH v2] " Jason A. Donenfeld
2016-11-13 20:45 ` David Ahern
2016-11-13 23:28 ` [WireGuard] [PATCH v3] " Jason A. Donenfeld
2016-11-14 1:36 ` [WireGuard] Debugging AllowedIps John Huttley
2016-11-14 1:39 ` Jason A. Donenfeld
2016-11-14 2:28 ` John Huttley
2016-11-14 2:59 ` Jason A. Donenfeld
2016-11-14 3:10 ` John Huttley
2016-11-14 16:19 ` [WireGuard] [PATCH v3] ip6_output: ensure flow saddr actually belongs to device David Ahern
[not found] ` <CAHmME9p6-mLSs84AwwfRXe8U3Z2sy6Dp9W9H0gKh0rcZuQAfZA@mail.gmail.com>
[not found] ` <CAHmME9qC4xqGOwJnauXrJBDkAtmmuJ+kJKL6ufuU9_XWKNFdSA@mail.gmail.com>
2016-11-14 16:54 ` Jason A. Donenfeld
2016-11-14 16:44 ` Hannes Frederic Sowa
2016-11-14 16:55 ` David Ahern
2016-11-14 17:04 ` Hannes Frederic Sowa
2016-11-14 17:17 ` David Ahern
2016-11-14 17:33 ` Hannes Frederic Sowa
2016-11-14 17:48 ` David Ahern
2016-11-14 18:33 ` Hannes Frederic Sowa
2016-11-15 0:45 ` Jason A. Donenfeld
2016-11-15 14:45 ` Hannes Frederic Sowa
2016-11-15 15:26 ` David Ahern
2016-11-13 20:19 ` [WireGuard] [PATCH] " Jason A. Donenfeld
2016-11-13 20:39 ` David Ahern
2016-11-13 0:51 ` [WireGuard] Source address fib invalidation on IPv6 Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0dbf5deb-bffb-4878-a268-1adb17c47676@cumulusnetworks.com \
--to=dsa@cumulusnetworks.com \
--cc=Jason@zx2c4.com \
--cc=hannes@stressinduktion.org \
--cc=hideaki.yoshifuji@miraclelinux.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).