netdev - [RFC PATCH] ipv6: do not create neighbor entries for local delivery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 07 Dec 2012 15:30:28 -0200
From:	Marcelo Ricardo Leitner <mleitner@...hat.com>
To:	netdev <netdev@...r.kernel.org>
CC:	Thomas Graf <tgraf@...hat.com>, Flavio Leitner <fbl@...hat.com>
Subject: [RFC PATCH] ipv6: do not create neighbor entries for local delivery

RFC comment:

Please note that I do not fully understand the impacts of this, thus why 
RFC. I don't know if this is the best way to address the issue.

I have a report that when using TPROXY and IPv6, neighbor cache gets 
flooded with empty entries, while this does not happen with IPv4. These 
empty entries looks like:

# ip -6 neigh show nud all   (I masked some bits)
...
20xx::f0xx:x:3xdb dev lo lladdr 00:00:00:00:00:00 NOARP
...

Note that this address was not directly reachable by this host. It was 1 
hop away, and still got a neighbor entry.

These entries seems to be not used during input. I disabled their 
creation and I could not notice any abnormal results.

Bellow the dashes, my original patch description. Applies to net-next.

Please advise.

Thanks,
Marcelo.

----------------

They will be created at output, if ever needed. This avoids creating
empty neighbor entries when TPROXYing/Forwarding packets for addresses
that are not even directly reachable.

Note that IPv4 already handles it this way. No neighbor entries are
created for local input.
---
  net/ipv6/route.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 
e229a3bc345dc4138a188282c4ab4f1717882832..e6058ab0bb94233da1eec3349e098175d5abf831 
100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -928,7 +928,7 @@ restart:
  	dst_hold(&rt->dst);
  	read_unlock_bh(&table->tb6_lock);
-	if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP))
+	if (!rt->n && !(rt->rt6i_flags & (RTF_NONEXTHOP|RTF_LOCAL)))
  		nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
  	else if (!(rt->dst.flags & DST_HOST))
  		nrt = rt6_alloc_clone(rt, &fl6->daddr);
-- 
1.7.11.7

View attachment "Seção da mensagem anexada" of type "text/plain" (0 bytes)