netdev - Re: [PATCH net] ipv6: fix src addr routing with the exception table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 May 2019 11:32:57 -0600
From:   David Ahern <dsahern@...il.com>
To:     Wei Wang <weiwan@...gle.com>
Cc:     Wei Wang <tracywwnj@...il.com>, David Miller <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Mikael Magnusson <mikael.kernel@...ts.m7n.se>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: [PATCH net] ipv6: fix src addr routing with the exception table

On 5/15/19 11:28 AM, Wei Wang wrote:
> From: Wei Wang <weiwan@...gle.com>
> Date: Wed, May 15, 2019 at 10:25 AM
> To: David Ahern
> Cc: Wei Wang, David Miller, Linux Kernel Network Developers, Martin
> KaFai Lau, Mikael Magnusson, Eric Dumazet
> 
>>>
>>> What about rt6_remove_exception_rt?
>>>
>>> You can add a 'cache' hook to ip/iproute.c to delete the cached routes
>>> and verify that it works. I seem to have misplaced my patch to do it.
>> I don't think rt6_remove_exception_rt() needs any change.
>> It is because it gets the route cache rt6_info as the input parameter,
>> not specific saddr or daddr from a flow or a packet.
>> It is guaranteed that the hash used in the exception table is
>> generated from rt6_info->rt6i_dst and rt6_info->rt6i_src.
>>
>> For the case where user tries to delete a cache route, ip6_route_del()
>> calls rt6_find_cached_rt() to find the cached route first. And
>> rt6_find_cached_rt() is taken care of to find the cached route
>> according to both passed in src addr and f6i->fib6_src.
>> So I think we are good here.
>>
>> From: David Ahern <dsahern@...il.com>
>> Date: Wed, May 15, 2019 at 9:38 AM
>> To: Wei Wang, David Miller, <netdev@...r.kernel.org>
>> Cc: Martin KaFai Lau, Wei Wang, Mikael Magnusson, Eric Dumazet
>>
>>> On 5/15/19 9:56 AM, David Ahern wrote:
>>>> You can add a 'cache' hook to ip/iproute.c to delete the cached routes
>>>> and verify that it works. I seem to have misplaced my patch to do it.
>>>
>>> found it.
> 
> Thanks. I patched it to iproute2 and tried it.
> The route cache is removed by doing:
> ip netns exec a ./ip -6 route del fd01::c from fd00::a cache 
> 

you have to pass in a device. The first line in ip6_del_cached_rt:

if (cfg->fc_ifindex && rt->dst.dev->ifindex != cfg->fc_ifindex)
                goto out;

'ip route get' is one way to check if it has been deleted. We really
need to add support for dumping exception routes.