netdev - Re: [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf packets by mistake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 25 Apr 2019 15:21:55 +0800
From:   linmiaohe <linmiaohe@...wei.com>
To:     David Ahern <dsahern@...il.com>, <pablo@...filter.org>,
        <kadlec@...ckhole.kfki.hu>, <fw@...len.de>, <davem@...emloft.net>,
        <kuznet@....inr.ac.ru>, <yoshfuji@...ux-ipv6.org>,
        <netfilter-devel@...r.kernel.org>, <coreteam@...filter.org>,
        <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC:     Mingfangsen <mingfangsen@...wei.com>
Subject: Re: [PATCH v2] net: netfilter: Fix ipv6 rp_filter dropping vrf
 packets by mistake



On 2019/4/24 23:24, David Ahern wrote:
> On 4/24/19 3:12 AM, linmiaohe wrote:
>> From: Miaohe Lin <linmiaohe@...wei.com>
>>
>> When firewall is enabled with rp_filter, vrf ipv6 packets
>> will be dropped because in device is vrf but out device
>> is an enslaved device. So rt->rt6i_idev->dev != dev and
>> maybe return false in func rpfilter_lookup_reverse6.
>>
>> Here is the out message when I ping the peer:
>> ip vrf exec vrf1 ping 2013::2 -c 1
>> 1 packets transmitted, 0 received, 100% packet loss, time 0ms
>>
>> The drop info in /var/log/message:
>> Apr 24 14:59:45 localhost kernel: [81316.158259] rpfilter_DROP: IN=vrf1
>> OUT= MAC=52:54:00:9e:dd:c1:52:54:00:4f:81:38:86:dd
>> SRC=2013:0000:0000:0000:0000:0000:0000:0002
>> DST=2013:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64
>> FLOWLBL=1032942 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14943 SEQ=1
>>
>> Signed-off-by: linmiaohe <linmiaohe@...wei.com>
>> ---
>>  net/ipv6/netfilter/ip6t_rpfilter.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
>> index c3c6b09acdc4..cf1070ab1252 100644
>> --- a/net/ipv6/netfilter/ip6t_rpfilter.c
>> +++ b/net/ipv6/netfilter/ip6t_rpfilter.c
>> @@ -73,6 +73,12 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
>>  		goto out;
>>  	}
>>
>> +	if (netif_is_l3_master(dev)) {
>> +		dev = dev_get_by_index_rcu(dev_net(dev), IP6CB(skb)->iif);
>> +		if (!dev)
>> +			goto out;
>> +	}
>> +
>>  	if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
>>  		ret = true;
>>   out:
>>
> 
> What about the case where XT_RPFILTER_LOOSE is set? flowi6_oif needs to
> be set to the dev->ifindex if dev is an l3 master.
> 

Thanks, you are right. I miss the case when XT_RPFILTER_LOOSE is set. flowi6_oif
needs to be set to the device ifindex if dev is an l3 master or l3 slave which
looks like this in function rpfilter_lookup_reverse6:

} else if ((flags & XT_RPFILTER_LOOSE) == 0) {
	fl6.flowi6_oif = dev->ifindex;
} else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev))
	fl6.flowi6_oif = dev->ifindex;

> And looking at the IPv4 version I do not see how it could be correct
> either. Have you tested it?
> 
> .
> 

I thought rp_filter is ok with ipv4 version because it works in my enviroment. But
I forgot rp_filter func in my enviroment is provided by sysctl rather than iptables
rpfilter. So I tested again and found we need to fix ipv4 version too.

Thanks for your remind, I will fix all of these and send a patch v2 soon.
Thanks.