netdev - Re: [PATCH net-next v4 3/3] udp6: Use Segment Routing Header for dest address if present

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Dec 2021 16:26:05 -0500
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        James Prestwood <prestwoj@...il.com>,
        Justin Iurman <justin.iurman@...ege.be>,
        Praveen Chaudhary <praveen5582@...il.com>,
        "Jason A . Donenfeld" <Jason@...c4.com>,
        Eric Dumazet <edumazet@...gle.com>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next v4 3/3] udp6: Use Segment Routing Header for dest
 address if present

On Wed, Dec 8, 2021 at 12:38 PM Andrew Lunn <andrew@...n.ch> wrote:
>
> When finding the socket to report an error on, if the invoking packet
> is using Segment Routing, the IPv6 destination address is that of an
> intermediate router, not the end destination. Extract the ultimate
> destination address from the segment address.
>
> This change allows traceroute to function in the presence of Segment
> Routing.
>
> Signed-off-by: Andrew Lunn <andrew@...n.ch>
> ---
>  include/net/seg6.h | 19 +++++++++++++++++++
>  net/ipv6/udp.c     |  3 ++-
>  2 files changed, 21 insertions(+), 1 deletion(-)
>
> diff --git a/include/net/seg6.h b/include/net/seg6.h
> index 02b0cd305787..af668f17b398 100644
> --- a/include/net/seg6.h
> +++ b/include/net/seg6.h
> @@ -65,4 +65,23 @@ extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
>  extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh);
>  extern int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr,
>                                u32 tbl_id);
> +
> +/* If the packet which invoked an ICMP error contains an SRH return
> + * the true destination address from within the SRH, otherwise use the
> + * destination address in the IP header.
> + */

nit: the above describes the behavior of the caller, not the function.
The function returns NULL if no SRH is found.

> +static inline const struct in6_addr *seg6_get_daddr(struct sk_buff *skb,
> +                                                   struct inet6_skb_parm *opt)
> +{
> +       struct ipv6_sr_hdr *srh;
> +
> +       if (opt->flags & IP6SKB_SEG6) {
> +               srh = (struct ipv6_sr_hdr *)(skb->data + opt->srhoff);
> +               return  &srh->segments[0];
> +       }
> +
> +       return NULL;
> +}
> +
> +
>  #endif
> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> index 6a0e569f0bb8..a14375e3f923 100644
> --- a/net/ipv6/udp.c
> +++ b/net/ipv6/udp.c
> @@ -40,6 +40,7 @@
>  #include <net/transp_v6.h>
>  #include <net/ip6_route.h>
>  #include <net/raw.h>
> +#include <net/seg6.h>
>  #include <net/tcp_states.h>
>  #include <net/ip6_checksum.h>
>  #include <net/ip6_tunnel.h>
> @@ -561,7 +562,7 @@ int __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>         struct ipv6_pinfo *np;
>         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
>         const struct in6_addr *saddr = &hdr->saddr;
> -       const struct in6_addr *daddr = &hdr->daddr;
> +       const struct in6_addr *daddr = seg6_get_daddr(skb, opt) ? : &hdr->daddr;
>         struct udphdr *uh = (struct udphdr *)(skb->data+offset);
>         bool tunnel = false;
>         struct sock *sk;
> --
> 2.33.1
>