lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 9 Apr 2014 01:03:29 +0300 (EEST) From: Julian Anastasov <ja@....bg> To: Cong Wang <xiyou.wangcong@...il.com> cc: netdev@...r.kernel.org, davem@...emloft.net, Eric Biederman <ebiederm@...ssion.com>, Cong Wang <cwang@...pensource.com> Subject: Re: [Patch net] ipv4: fib: check forwarding before checking send_redirects Hello, On Tue, 8 Apr 2014, Cong Wang wrote: > From: Cong Wang <cwang@...pensource.com> > > We have seen in a weird case we had to disable send_redirects in order > to pass rp filter check even though we don't set forwarding at all. > This looks wrong, at least according to ip-sysctl.txt send_redirects should > only make sense when we enable forwarding. > > Cc: Eric Biederman <ebiederm@...ssion.com> > Cc: Julian Anastasov <ja@....bg> > Cc: David S. Miller <davem@...emloft.net> > Signed-off-by: Cong Wang <xiyou.wangcong@...il.com> > Signed-off-by: Cong Wang <cwang@...pensource.com> > > --- > diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c > index 1a629f8..3f9e324 100644 > --- a/net/ipv4/fib_frontend.c > +++ b/net/ipv4/fib_frontend.c > @@ -321,7 +321,8 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, > int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev); > > if (!r && !fib_num_tclassid_users(dev_net(dev)) && > - (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) { > + (dev->ifindex != oif || !IN_DEV_FORWARD(idev) || > + !IN_DEV_TX_REDIRECTS(idev))) { Very strange. Above IN_DEV_FORWARD matters only when dev->ifindex == oif. And this can happen only for the ip_route_input_slow -> ip_mkroute_input -> __mkroute_input case. We are not supposed to reach fib_validate_source because ip_mkroute_input is after the IN_DEV_FORWARD check in ip_route_input_slow. This was for forwarding. If the case is not forwarding but local delivery, the dev->ifindex != oif condition should be always true because we provide 0 or LOOPBACK_IFINDEX for oif. So, the question is how we reach fib_validate_source with dev->ifindex == oif and IN_DEV_FORWARD(idev) already checked to be != 0 ? > *itag = 0; > return 0; > } Regards -- Julian Anastasov <ja@....bg> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists