linux-kernel - [PATCH 3.16 224/370] netfilter: rpfilter: fix incorrect loopback packet judgment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1489146383.14507967@decadent.org.uk>
Date:   Fri, 10 Mar 2017 11:46:23 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org,
        "Pablo Neira Ayuso" <pablo@...filter.org>,
        "Liping Zhang" <zlpnobody@...il.com>
Subject: [PATCH 3.16 224/370] netfilter: rpfilter: fix incorrect loopback
 packet judgment

3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Liping Zhang <zlpnobody@...il.com>

commit 6443ebc3fdd6f3c766d9442c18be274b3d736050 upstream.

Currently, we check the existing rtable in PREROUTING hook, if RTCF_LOCAL
is set, we assume that the packet is loopback.

But this assumption is incorrect, for example, a packet encapsulated
in ipsec transport mode was received and routed to local, after
decapsulation, it would be delivered to local again, and the rtable
was not dropped, so RTCF_LOCAL check would trigger. But actually, the
packet was not loopback.

So for these normal loopback packets, we can check whether the in device
is IFF_LOOPBACK or not. For these locally generated broadcast/multicast,
we can check whether the skb->pkt_type is PACKET_LOOPBACK or not.

Finally, there's a subtle difference between nft fib expr and xtables
rpfilter extension, user can add the following nft rule to do strict
rpfilter check:
  # nft add rule x y meta iif eth0 fib saddr . iif oif != eth0 drop

So when the packet is loopback, it's better to store the in device
instead of the LOOPBACK_IFINDEX, otherwise, after adding the above
nft rule, locally generated broad/multicast packets will be dropped
incorrectly.

Fixes: f83a7ea2075c ("netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too")
Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Liping Zhang <zlpnobody@...il.com>
Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
[bwh: Backported to 3.16:
 - Drop changs to nftables
 - s/xt_in\(par\)/par->in/]
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -64,10 +64,10 @@ static bool rpfilter_lookup_reverse(stru
 	return dev_match || flags & XT_RPFILTER_LOOSE;
 }

-static bool rpfilter_is_local(const struct sk_buff *skb)
+static bool
+rpfilter_is_loopback(const struct sk_buff *skb, const struct net_device *in)
 {
-	const struct rtable *rt = skb_rtable(skb);
-	return rt && (rt->rt_flags & RTCF_LOCAL);
+	return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
 }

 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -80,7 +80,7 @@ static bool rpfilter_mt(const struct sk_
 	info = par->matchinfo;
 	invert = info->flags & XT_RPFILTER_INVERT;

-	if (rpfilter_is_local(skb))
+	if (rpfilter_is_loopback(skb, par->in))
 		return true ^ invert;

 	iph = ip_hdr(skb);
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -72,10 +72,10 @@ static bool rpfilter_lookup_reverse6(con
 	return ret;
 }

-static bool rpfilter_is_local(const struct sk_buff *skb)
+static bool
+rpfilter_is_loopback(const struct sk_buff *skb, const struct net_device *in)
 {
-	const struct rt6_info *rt = (const void *) skb_dst(skb);
-	return rt && (rt->rt6i_flags & RTF_LOCAL);
+	return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
 }

 static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -85,7 +85,7 @@ static bool rpfilter_mt(const struct sk_
 	struct ipv6hdr *iph;
 	bool invert = info->flags & XT_RPFILTER_INVERT;

-	if (rpfilter_is_local(skb))
+	if (rpfilter_is_loopback(skb, par->in))
 		return true ^ invert;

 	iph = ipv6_hdr(skb);