From: David Ahern <dsa@cumulusnetworks.com>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>,
Netdev <netdev@vger.kernel.org>,
WireGuard mailing list <wireguard@lists.zx2c4.com>,
LKML <linux-kernel@vger.kernel.org>,
YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>
Subject: Re: [WireGuard] [PATCH v2] ip6_output: ensure flow saddr actually belongs to device
Date: Sun, 13 Nov 2016 13:45:31 -0700 [thread overview]
Message-ID: <27cccef1-06d9-74b3-5b8a-912850119a76@cumulusnetworks.com> (raw)
In-Reply-To: <20161113190251.1027-1-Jason@zx2c4.com>
On 11/13/16 12:02 PM, Jason A. Donenfeld wrote:
> This puts the IPv6 routing functions in parity with the IPv4 routing
> functions. Namely, we now check in v6 that if a flowi6 requests an
> saddr, the returned dst actually corresponds to a net device that has
> that saddr. This mirrors the v4 logic with __ip_dev_find in
> __ip_route_output_key_hash. In the event that the returned dst is not
> for a dst with a dev that has the saddr, we return -EINVAL, just like
> v4; this makes it easy to use the same error handlers for both cases.
>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> Cc: David Ahern <dsa@cumulusnetworks.com>
> ---
> Changes from v1:
> This moves the check to the top and now sees if it's a valid address
> on _any_ device, not just the one in dst.
>
> include/net/ipv6.h | 2 ++
> net/ipv6/ip6_output.c | 28 ++++++++++++++++++++++++++++
> 2 files changed, 30 insertions(+)
>
> diff --git a/include/net/ipv6.h b/include/net/ipv6.h
> index 8fed1cd..e5dc14f 100644
> --- a/include/net/ipv6.h
> +++ b/include/net/ipv6.h
> @@ -914,6 +914,8 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
> const struct in6_addr *final_dst);
> struct dst_entry *ip6_blackhole_route(struct net *net,
> struct dst_entry *orig_dst);
> +struct net_device *__ip6_dev_find(struct net *net, struct in6_addr *addr,
> + bool devref);
>
> /*
> * skb processing functions
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 6001e78..371170b 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -916,6 +916,30 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
> return dst;
> }
>
> +/**
> + * __ip6_dev_find - find the first device with a given source address.
> + * @net: the net namespace
> + * @addr: the source address
> + * @devref: if true, take a reference on the found device
> + *
> + * If a caller uses devref=false, it should be protected by RCU, or RTNL
> + */
> +struct net_device *__ip6_dev_find(struct net *net, struct in6_addr *addr, bool devref)
> +{
> + struct net_device *result;
> +
> + rcu_read_lock();
> + for_each_netdev_rcu(net, result) {
> + if (ipv6_chk_addr(net, addr, result, 1))
> + break;
> + }
> + if (result && devref)
> + dev_hold(result);
> + rcu_read_unlock();
> + return result;
> +}
> +EXPORT_SYMBOL(__ip6_dev_find);
You don't need a new function to walk all interfaces; just use ipv6_chk_addr with a dev arg of NULL. IPv6 has a hash table with all unicast addresses -- inet6_addr_lst. ipv6_chk_addr is checking that list for the address in question. The actual device is not relevant for verifying the address is a valid local one (though the device can be returned from ifp->idev->dev if ever needed).
So drop the above ...
> +
> static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
> struct dst_entry **dst, struct flowi6 *fl6)
> {
> @@ -926,6 +950,10 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
> int err;
> int flags = 0;
>
> + if (!ipv6_addr_any(&fl6->saddr) &&
> + !__ip6_dev_find(net, &fl6->saddr, false))
... and just use ipv6_chk_addr here.
> + return -EINVAL;
> +
> /* The correct way to handle this would be to do
> * ip6_route_get_saddr, and then ip6_route_output; however,
> * the route-specific preferred source forces the
>
next prev parent reply other threads:[~2016-11-13 20:43 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-11 19:29 [WireGuard] Source address fib invalidation on IPv6 Jason A. Donenfeld
2016-11-11 22:14 ` David Ahern
2016-11-12 2:18 ` Jason A. Donenfeld
2016-11-12 15:40 ` Jason A. Donenfeld
2016-11-12 18:14 ` David Ahern
2016-11-12 19:08 ` Jason A. Donenfeld
2016-11-13 0:43 ` Jason A. Donenfeld
2016-11-13 0:51 ` Hannes Frederic Sowa
2016-11-13 1:00 ` Jason A. Donenfeld
2016-11-13 13:23 ` [WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device Jason A. Donenfeld
2016-11-13 16:30 ` David Ahern
2016-11-13 19:02 ` [WireGuard] [PATCH v2] " Jason A. Donenfeld
2016-11-13 20:45 ` David Ahern [this message]
2016-11-13 23:28 ` [WireGuard] [PATCH v3] " Jason A. Donenfeld
2016-11-14 1:36 ` [WireGuard] Debugging AllowedIps John Huttley
2016-11-14 1:39 ` Jason A. Donenfeld
2016-11-14 2:28 ` John Huttley
2016-11-14 2:59 ` Jason A. Donenfeld
2016-11-14 3:10 ` John Huttley
2016-11-14 16:19 ` [WireGuard] [PATCH v3] ip6_output: ensure flow saddr actually belongs to device David Ahern
[not found] ` <CAHmME9p6-mLSs84AwwfRXe8U3Z2sy6Dp9W9H0gKh0rcZuQAfZA@mail.gmail.com>
[not found] ` <CAHmME9qC4xqGOwJnauXrJBDkAtmmuJ+kJKL6ufuU9_XWKNFdSA@mail.gmail.com>
2016-11-14 16:54 ` Jason A. Donenfeld
2016-11-14 16:44 ` Hannes Frederic Sowa
2016-11-14 16:55 ` David Ahern
2016-11-14 17:04 ` Hannes Frederic Sowa
2016-11-14 17:17 ` David Ahern
2016-11-14 17:33 ` Hannes Frederic Sowa
2016-11-14 17:48 ` David Ahern
2016-11-14 18:33 ` Hannes Frederic Sowa
2016-11-15 0:45 ` Jason A. Donenfeld
2016-11-15 14:45 ` Hannes Frederic Sowa
2016-11-15 15:26 ` David Ahern
2016-11-13 20:19 ` [WireGuard] [PATCH] " Jason A. Donenfeld
2016-11-13 20:39 ` David Ahern
2016-11-13 0:51 ` [WireGuard] Source address fib invalidation on IPv6 Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=27cccef1-06d9-74b3-5b8a-912850119a76@cumulusnetworks.com \
--to=dsa@cumulusnetworks.com \
--cc=Jason@zx2c4.com \
--cc=hannes@stressinduktion.org \
--cc=hideaki.yoshifuji@miraclelinux.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).