netdev - Re: [PATCH net-next 2/3] rds: Enable RDS IPv6 support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 26 Jun 2018 13:30:41 +0800
From:   Ka-Cheong Poon <ka-cheong.poon@...cle.com>
To:     Sowmini Varadhan <sowmini.varadhan@...cle.com>
Cc:     netdev@...r.kernel.org, santosh.shilimkar@...cle.com,
        davem@...emloft.net, rds-devel@....oracle.com
Subject: Re: [PATCH net-next 2/3] rds: Enable RDS IPv6 support

On 06/26/2018 01:50 AM, Sowmini Varadhan wrote:

>> If a socket is bound, I guess the scope_id should be used.  So
>> if a socket is not bound to a link local address and the socket
>> is used to sent to a link local peer, it should fail.
> 
> PF_RDS sockets *MUST* alwasy be bound.  See
> Documentation/networking/rds.txt:
> "   Sockets must be bound before you can send or receive data.
>      This is needed because binding also selects a transport and
>      attaches it to the socket. Once bound, the transport assignment
>      does not change."
> 
> Also, rds_sendmsg checks this (from net-next, your version
> has the equivalent ipv6_addr_any etc check):
> 
>          if (daddr == 0 || rs->rs_bound_addr == 0) {
>                  release_sock(sk);
>                  ret = -ENOTCONN; /* XXX not a great errno */
>                  goto out;
>          }


I think you misunderstood what I wrote.  The above is in response
to your original question:

--
 > And this is even more confusing because the fastpath in rds_sendmsg
 > does not take the bound_scope_id into consideration at all:
 > 1213         if (rs->rs_conn && 
ipv6_addr_equal(&rs->rs_conn->c_faddr, &daddr))
 > 1214                 conn = rs->rs_conn;
 > 1215         else {
 > 1216                 conn = rds_conn_create_outgoing( /* .. */, scope_id)
 > so if I erroneously passed a msg_name on a connected rds socket, what
 > would happen? (see also question about rds_connect() itself, below)
--


My answer to this is that if a socket is not bound to a link
local address (meaning it is bound to a non-link local address)
and it is used to send to a link local peer, I think it should
fail.  This is consistent with the scope_id check I mentioned in
the previous mail.  If the socket is not bound to a link local
address, the bound_scope_id is 0.  So if the socket is used to
send to a link local address (which has a non-zero scope_id), the
check will catch it and fail the call.  A new conn should not
be created in this case.



-- 
K. Poon
ka-cheong.poon@...cle.com