linux-kernel - Re: [PATCH] ipv6: Fixed source specific default route handling.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 22 Jun 2015 00:35:50 +0200
From:	Matthias Schiffer <mschiffer@...verse-factory.net>
To:	Markus Stenberg <markus.stenberg@....fi>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Steven Barth <steven@...link.org>
Subject: Re: [PATCH] ipv6: Fixed source specific default route handling.

On 06/22/2015 12:05 AM, Markus Stenberg wrote:
> Prefsrc is essentially historic non IPv6 construct. IPv6 SAS is based on dst, src, metric ordered lookup just like the routing is too ( lookup rfc, some src specific routing drafts for details ). 
> 
> Therefore I do not see a problem. If you want specific SA, add same route with higher metric and/or (more) specific src match. 
> 
> There might be bugs there tho, but that is how it should work. As SAS is supposed to happen before routing ( see rfc ) the prefsrc is .. Cough.
> 
> -Markus
> 

Could you explain in detail what you mean with "If you want specific SA,
add same route with higher metric and/or (more) specific src match."?
Routes aren't bound to specific addresses except via the "src" attribute
(which is called prefsrc in the kernel), which is exactly what it not
working. I can't control the chosen source address at all when
source-specific routes are involved.

Also, metric-based route selection is broken when source-specific routes
are involved. The commands mentioned in my first mail will create the
following configuration:

# ip a
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
UNKNOWN group default qlen 500
    link/ether 22:46:f4:9c:9e:3a brd ff:ff:ff:ff:ff:ff
    inet6 fd00::20/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::2046:f4ff:fe9c:9e3a/64 scope link
       valid_lft forever preferred_lft forever
4: test@...0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
state UNKNOWN group default
    link/ether ae:2b:02:16:23:0f brd ff:ff:ff:ff:ff:ff
    inet6 fd00::1/128 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ac2b:2ff:fe16:230f/64 scope link
       valid_lft forever preferred_lft forever

# ip -6 r
fd00::/64 from fd00::/64 dev eth0 metric 1024
fd00::1 dev test proto kernel metric 256
fd00::/64 dev eth0 proto kernel metric 256

The only route I have added manually is the source-specific one, the
other two have been created by address assignment. Adding a "src"
address to the source-specific route has no effect.

Even though the source-specific route has a higher metric than the
generic one, the source-specific one shadows the generic route.

Thanks for your reply,
Matthias


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)