netdev - Re: [PATCH net] udp: only choose unbound UDP socket for multicast when not in a VRF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e9d20a8f-146d-e9f3-4ef5-22a2f882146f@gmail.com>
Date:   Tue, 4 Jun 2019 11:23:27 -0600
From:   David Ahern <dsahern@...il.com>
To:     Tim Beale <timbeale@...alyst.net.nz>, netdev@...r.kernel.org
Cc:     davem@...emloft.net, kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org
Subject: Re: [PATCH net] udp: only choose unbound UDP socket for multicast
 when not in a VRF

On 6/3/19 7:56 PM, Tim Beale wrote:
> By default, packets received in another VRF should not be passed to an
> unbound socket in the default VRF. This patch updates the IPv4 UDP
> multicast logic to match the unicast VRF logic (in compute_score()),
> as well as the IPv6 mcast logic (in __udp_v6_is_mcast_sock()).
> 
> The particular case I noticed was DHCP discover packets going
> to the 255.255.255.255 address, which are handled by
> __udp4_lib_mcast_deliver(). The previous code meant that running
> multiple different DHCP server or relay agent instances across VRFs
> did not work correctly - any server/relay agent in the default VRF
> received DHCP discover packets for all other VRFs.
> 
> Signed-off-by: Tim Beale <timbeale@...alyst.net.nz>
> ---
>  net/ipv4/udp.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index 8fb250e..efe9283 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -538,8 +538,7 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk,
>  	    (inet->inet_dport != rmt_port && inet->inet_dport) ||
>  	    (inet->inet_rcv_saddr && inet->inet_rcv_saddr != loc_addr) ||
>  	    ipv6_only_sock(sk) ||
> -	    (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif &&
> -	     sk->sk_bound_dev_if != sdif))
> +	    !udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
>  		return false;
>  	if (!ip_mc_sf_allow(sk, loc_addr, rmt_addr, dif, sdif))
>  		return false;
> 

Thanks for the fix.

Really should have been apart of this commit:

Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen
when not in a VRF")
Reviewed-by: David Ahern <dsahern@...il.com>

IPv6 mcast socket lookup was converted to udp_sk_bound_dev_eq, so v6
seems ok.