netdev - Re: [PATCH net-next] net: ipv6: put host and anycast routes on device with address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Aug 2017 10:56:54 -0600
From:   David Ahern <dsahern@...il.com>
To:     netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Cc:     yoshfuji@...ux-ipv6.org, hannes@...essinduktion.org
Subject: Re: [PATCH net-next] net: ipv6: put host and anycast routes on device
 with address

On 8/16/17 4:37 PM, David Ahern wrote:
> One nagging difference between ipv4 and ipv6 is host routes for ipv6
> addresses are installed using the loopback device or VRF / L3 Master
> device. e.g.,
> 
>     2001:db8:1::/120 dev veth0 proto kernel metric 256 pref medium
>     local 2001:db8:1::1 dev lo table local proto kernel metric 0 pref medium
> 
> Using the loopback device is convenient -- necessary for local tx, but
> has some nasty side effects, most notably setting the 'lo' device down
> causes all host routes for all local IPv6 address to be removed from the
> FIB and completely breaks IPv6 networking across all interfaces.
> 
> This patch puts FIB entries for IPv6 routes against the device. This
> simplifies the routes in the FIB, for example by making dst->dev and
> rt6i_idev->dev the same (a future patch can look at removing the device
> reference taken for rt6i_idev for FIB entries). For example:
> 
>     $ ip -6 r ls table all | grep veth1
>     2001:db8:99::/120 dev veth1 proto kernel metric 256 pref medium
>     anycast 2001:db8:99:: dev veth1 table local proto kernel metric 0 pref medium
>     local 2001:db8:99::1 dev veth1 table local proto kernel metric 0 pref medium
> 
> When copies are made on FIB lookups, the cloned route has dst->dev
> set to loopback (or the L3 master device). This is needed for the
> local Tx of packets to local addresses.
> 
> With fib entries allocated against the real network device, the addrconf
> code that reinserts host routes on admin up of 'lo' is no longer needed.
> 
> Signed-off-by: David Ahern <dsahern@...il.com>
> ---
>  net/ipv6/addrconf.c | 42 ------------------------------------------
>  net/ipv6/route.c    | 46 ++++++++++++++++++++++++++++++++++------------
>  2 files changed, 34 insertions(+), 54 deletions(-)
>

DaveM: please drop this one. I found a use case that is failing: UDP
packets to a local linklocal address with no server are not getting the
ICMP unreachable. Will send a v2 when tests complete.