linux-kernel - Re: [PATCH v2] IPv6: sr: Fix End.X nexthop to use oif.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Oct 2020 09:17:02 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Reji Thomas <rejithomas.d@...il.com>
Cc:     Reji Thomas <rejithomas@...iper.net>, davem@...emloft.net,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel test robot <lkp@...el.com>,
        Mathieu Xhonneux <m.xhonneux@...il.com>,
        David Lebrun <david.lebrun@...ouvain.be>
Subject: Re: [PATCH v2] IPv6: sr: Fix End.X nexthop to use oif.

On Mon, 19 Oct 2020 09:25:12 +0530 Reji Thomas wrote:
> > > @@ -566,7 +583,8 @@ static struct seg6_action_desc seg6_action_table[] = {
> > >       },
> > >       {
> > >               .action         = SEG6_LOCAL_ACTION_END_X,
> > > -             .attrs          = (1 << SEG6_LOCAL_NH6),
> > > +             .attrs          = ((1 << SEG6_LOCAL_NH6) |
> > > +                                (1 << SEG6_LOCAL_OIF)),
> > >               .input          = input_action_end_x,
> > >       },
> > >       {  
> >
> > If you set this parse_nla_action() will reject all
> > SEG6_LOCAL_ACTION_END_X without OIF.
> >
> > As you say the OIF is only required for using link local addresses,
> > so this change breaks perfectly legitimate configurations.
> >
> > Can we instead only warn about the missing OIF, and only do that when
> > nh is link local?
> >  
> End.X is defined as an adjacency-sid and is used to select a specific link to a
> neighbor for both global and link-local addresses. The intention was
> to drop the
> packet even for global addresses if the route via the specific
> interface is not found.
> Alternatively(believe semantically correct for End.X definition) I
> could do a neighbor lookup
> for nexthop address over specific interface and send the packet out.

If we can save the device lookup and still be semantically correct,
that's probably better.