netdev - [PATCH] net/ipv6/route.c: packets originating on device match lo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 25 Jun 2012 16:50:30 +1000
From:	David McCullough <david_mccullough@...fee.com>
To:	<netdev@...r.kernel.org>
CC:	<david_mccullough@...fee.com>
Subject: [PATCH] net/ipv6/route.c: packets originating on device match lo


Hi all,

Seems like the special case of "iif lo" when using rules to control packets
is broken for IPv6 traffic.  The section from the ip man page is:

   iif NAME
          select  the incoming device to match.  If the interface is loop‐
          back, the rule only matches packets originating from this  host.
          This  means that you may create separate routing tables for for‐
          warded and local packets and, hence, completely segregate them.

If I run the following configuration:

    ifconfig eth0 192.168.0.1 netmask 255.255.255.0
    ip addr add fec0:0:0:2::1/64 dev eth0

    ip route add table 200 unreachable default
    ip -6 route add table 200 unreachable default

    ip rule add to 192.168.0.2 table 200 iif lo
    ip -6 rule add to fec0:0:0:2::2 table 200 iif lo

and then test with:

    # ping 192.168.0.2
    connect: Network is unreachable
    # ping6 fec0:0:0:2::2
    PING fec0:0:0:2::2(fec0:0:0:2::2) 56 data bytes
    64 bytes from fec0:0:0:2::2: icmp_seq=1 ttl=64 time=0.648 ms
    ...

The patch below is against linux-3.4.  I am not sure if its the best
solution but it appears to fix the case above:

    # ping6 fec0:0:0:2::2
    connect: Network is unreachable

and does not appear to affect forwarded packets is the few cases I have
tried.  Tested on linux-3.4 and iproute2-3.4.0, Feedback appreciated :-)

Thanks,
Davidm

Signed-off-by: David McCullough <david_mccullough@...fee.com>

diff -p -u -r1.1.1.59 route.c
--- linux-3.4/net/ipv6/route.c	21 May 2012 23:15:01 -0000	1.1.1.59
+++ linux-3.4/net/ipv6/route.c	25 Jun 2012 05:43:50 -0000
@@ -931,6 +931,9 @@ struct dst_entry * ip6_route_output(stru
 {
 	int flags = 0;
 
+	if (fl6->flowi6_iif == 0)
+		fl6->flowi6_iif = net->loopback_dev->ifindex;
+		
 	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
 		flags |= RT6_LOOKUP_F_IFACE;
 

-- 
David McCullough,      david_mccullough@...fee.com,  Ph:+61 734352815
McAfee - SnapGear      http://www.mcafee.com         http://www.uCdot.org
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html