netdev - Sysctl addr_gen_mode does not control tunnel link-local addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211020013005.GA4864@ICIPI.localdomain>
Date:   Tue, 19 Oct 2021 21:30:05 -0400
From:   Stephen Suryaputra <ssuryaextr@...il.com>
To:     netdev@...r.kernel.org
Cc:     a@...table.cc
Subject: Sysctl addr_gen_mode does not control tunnel link-local addr

Hi,

I noticed that tunnels, especially sit before commit e5dd729460ca8
("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL
address"), generates link-local addr regardless of addr_gen_mode
setting. Is this a bug, or is there a specific reason?

In my system, the link-local addr are generated by a userspace process.
So, we set net.ipv6.conf.<dev>.addr_gen_mode to 1 (IN6_ADDR_GEN_MODE_NONE).

The commit e5dd729460ca8 doesn't change the behavior as it is renaming
sit_add_v4_addrs() to add_v4_addrs() as make it generic for GRE/IP6GRE
cases. I'm not sure what the current behavior is for GRE, i.e. whether
addr_gen_mode can control the generation of link-local addr.

If this is a bug or oversight, I think this diff should fix it and I can
put a formal patch.

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c6a90b7bbb70..da7e83699eef 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3392,6 +3392,8 @@ static void addrconf_sit_config(struct net_device
*dev)
                return;
        }

+       if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
+               return;
        add_v4_addrs(idev);

        if (dev->flags&IFF_POINTOPOINT)

The commit mention about addressing violation of RFC4291 on GRE and the diff
above doesn't cause it to change as the default addr_gen_mode is 0
(IN6_ADDR_GEN_MODE_EUI64).

Thanks,
Stephen.