netdev - Re: [PATCH] ipv6: Fixed source specific default route handling.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 22 Jun 2015 00:01:54 +0100
From:	Markus Stenberg <markus.stenberg@....fi>
To:	Matthias Schiffer <mschiffer@...verse-factory.net>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Steven Barth <steven@...link.org>
Subject: Re: [PATCH] ipv6: Fixed source specific default route handling.

You have /128 dst. To override it you need dst/128 AND src/>0 route. ( or just /128 dst and higher metric). 

Sorry if I am bit unclear - can explain better given real keyboard but that is avail only week from now. 

-Markus

(on the road, via iPhone)

21.6.2015 23.35、Matthias Schiffer <mschiffer@...verse-factory.net> のメッセージ:

>> On 06/22/2015 12:05 AM, Markus Stenberg wrote:
>> Prefsrc is essentially historic non IPv6 construct. IPv6 SAS is based on dst, src, metric ordered lookup just like the routing is too ( lookup rfc, some src specific routing drafts for details ). 
>> 
>> Therefore I do not see a problem. If you want specific SA, add same route with higher metric and/or (more) specific src match. 
>> 
>> There might be bugs there tho, but that is how it should work. As SAS is supposed to happen before routing ( see rfc ) the prefsrc is .. Cough.
>> 
>> -Markus
> 
> Could you explain in detail what you mean with "If you want specific SA,
> add same route with higher metric and/or (more) specific src match."?
> Routes aren't bound to specific addresses except via the "src" attribute
> (which is called prefsrc in the kernel), which is exactly what it not
> working. I can't control the chosen source address at all when
> source-specific routes are involved.
> 
> Also, metric-based route selection is broken when source-specific routes
> are involved. The commands mentioned in my first mail will create the
> following configuration:
> 
> # ip a
> 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
> UNKNOWN group default qlen 500
>    link/ether 22:46:f4:9c:9e:3a brd ff:ff:ff:ff:ff:ff
>    inet6 fd00::20/64 scope global
>       valid_lft forever preferred_lft forever
>    inet6 fe80::2046:f4ff:fe9c:9e3a/64 scope link
>       valid_lft forever preferred_lft forever
> 4: test@...0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
> state UNKNOWN group default
>    link/ether ae:2b:02:16:23:0f brd ff:ff:ff:ff:ff:ff
>    inet6 fd00::1/128 scope global
>       valid_lft forever preferred_lft forever
>    inet6 fe80::ac2b:2ff:fe16:230f/64 scope link
>       valid_lft forever preferred_lft forever
> 
> # ip -6 r
> fd00::/64 from fd00::/64 dev eth0 metric 1024
> fd00::1 dev test proto kernel metric 256
> fd00::/64 dev eth0 proto kernel metric 256
> 
> The only route I have added manually is the source-specific one, the
> other two have been created by address assignment. Adding a "src"
> address to the source-specific route has no effect.
> 
> Even though the source-specific route has a higher metric than the
> generic one, the source-specific one shadows the generic route.
> 
> Thanks for your reply,
> Matthias
> 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in