linux-kernel - Re: [PATCH net v2] ipv6: socket SO_BINDTODEVICE lookup routing fail without IPv6 rule.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5dbb7b8db7f4d31b620e5780e4716a9881252534.camel@mediatek.com>
Date: Tue, 14 Jan 2025 03:11:34 +0000
From: Shiming Cheng (成诗明)
	<Shiming.Cheng@...iatek.com>
To: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	"dsahern@...nel.org" <dsahern@...nel.org>, "horms@...nel.org"
	<horms@...nel.org>, "kuba@...nel.org" <kuba@...nel.org>, "pabeni@...hat.com"
	<pabeni@...hat.com>, "edumazet@...gle.com" <edumazet@...gle.com>,
	"willemdebruijn.kernel@...il.com" <willemdebruijn.kernel@...il.com>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "davem@...emloft.net" <davem@...emloft.net>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Lena Wang (王娜) <Lena.Wang@...iatek.com>
Subject: Re: [PATCH net v2] ipv6: socket SO_BINDTODEVICE lookup routing fail
 without IPv6 rule.

Dear David

Attached are the test script commands and test results.
Please review.

Thanks

#!/bin/bash

  ip netns add test1
  ip netns add test2

  ip link add dev veth0 netns test1 type veth peer name veth0 netns
test2
  ip link add dev veth1 netns test2 type dummy

  ip netns exec test1 ip link set dev veth0 up
  ip netns exec test2 ip link set dev veth0 up
  ip netns exec test2 ip link set dev veth1 up

  ip netns exec test1 ip addr add 10.0.8.1/24 dev veth0
  ip netns exec test2 ip addr add 10.0.8.2/24 dev veth0
  ip netns exec test2 ip addr add 10.0.9.2/24 dev veth1

  ip -6 -netns test1 addr add fdaa::1 dev veth0
  ip -6 -netns test2 addr add fdaa::2 dev veth0
  ip -6 -netns test2 addr add fdab::2 dev veth1

  ip -netns test1 route add default via 10.0.8.2
  ip -netns test2 route add default via 10.0.8.1

  ip -6 -netns test1 route add fdaa::2 dev veth0
  ip -6 -netns test2 route add fdaa::1 dev veth0
  ip -6 -netns test1 route add default via fdaa::2
  ip -6 -netns test2 route add default via fdaa::1

  ip -6 -netns test1 rule add from all unreachable pri 1
  ip -netns test1 rule add from all unreachable pri 1

test results as below:
1.test ipv4 pass
xxx:/ # ip netns exec test1  ping -I veth0 10.0.9.2
PING 10.0.9.2 (10.0.9.2) from 10.0.8.1 veth0: 56(84) bytes of data.
64 bytes from 10.0.9.2: icmp_seq=1 ttl=64 time=0.164 ms
64 bytes from 10.0.9.2: icmp_seq=2 ttl=64 time=0.154 ms
64 bytes from 10.0.9.2: icmp_seq=3 ttl=64 time=0.148 ms
64 bytes from 10.0.9.2: icmp_seq=4 ttl=64 time=0.150 ms


2.test ipv6 fail
xxx:/ # ip netns exec test1  ping6 -I veth0 fdab::2
connect: Network is unreachable

3.test ipv6 pass without unreachable rule
xxx:/ #  ip -6 -netns test1 rule del from all unreachable pri 1
xxx:/ # ip netns exec test1  ping6 -I veth0 fdab::2
PING fdab::2(fdab::2) from fdaa::1 veth0: 56 data bytes
64 bytes from fdab::2: icmp_seq=1 ttl=64 time=0.098 ms
64 bytes from fdab::2: icmp_seq=2 ttl=64 time=0.201 ms
64 bytes from fdab::2: icmp_seq=3 ttl=64 time=0.215 ms


On Fri, 2025-01-03 at 08:31 -0700, David Ahern wrote:
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
> 
> 
> On 1/3/25 3:27 AM, Shiming Cheng (成诗明) wrote:
> > Test cases will be provided later, below are the corresponding IP
> > rule
> > configurations for IPv4 and IPv6 that i provided, as well as the
> > differences in ping results, the IPv4 result passed, but the IPv6
> > result
> > failed, after adding this patch, the IPv6 result passed.
> 
> I do not want the output of a complicated stack of ip rules with a
> ping
> a command.
> 
> Provide a simplistic set of commands that configure the stack and
> show
> what you believe is a problem. Anyone on this list should be able to
> quickly reproduce the setup to verify it is a problem and investigate
> what is happening.