lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 31 Mar 2022 09:13:10 +0000
From:   "Pudak, Filip" <>
To:     David Ahern <>,
        "Xiao, Jiguang" <>,
        "" <>,
        "" <>,
        "" <>,
        "" <>,
        "" <>
Subject: RE: This counter "ip6InNoRoutes" does not follow the RFC4293
 specification implementation

Hi David,

So we end up in ip6_pkt_discard -> ip6_pkt_drop :

if (netif_is_l3_master(skb->dev) &&
	    dst->dev == net->loopback_dev)
		idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
		idev = ip6_dst_idev(dst);

	switch (ipstats_mib_noroutes) {
		type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
		if (type == IPV6_ADDR_ANY) {
		IP6_INC_STATS(net, idev, ipstats_mib_noroutes);

What happens in the case where the l3mdev is not used, is that we go into the else branch(idev = ip6_dst_idev(dst);) and then we can see that the counter is incremented on the loopback IF.

So is the only option that l3mdev should be used or is it strange to expect that the idev where the INNOROUTES should increment is the ingress device by default in this case?

Best Regards,
Filip Pudak

-----Original Message-----
From: David Ahern <> 
Sent: Wednesday, 9 March 2022 05:50
To: Xiao, Jiguang <>;;;;;
Cc: Pudak, Filip <>
Subject: Re: This counter "ip6InNoRoutes" does not follow the RFC4293 specification implementation

On 3/8/22 7:16 PM, Xiao, Jiguang wrote:
> Hi David
> To confirm whether my test method is correct, could you please briefly describe your test procedure? 

no formal test. Code analysis (ip6_pkt_discard{,_out} -> ip6_pkt_drop) shows the counters that should be incrementing and then looking at the counters on a local server.

FIB Lookup failures should generate a dst with one of these handlers:

static void ip6_rt_init_dst_reject(struct rt6_info *rt, u8 fib6_type) {
        rt->dst.error = ip6_rt_type_to_error(fib6_type);

        switch (fib6_type) {
        case RTN_BLACKHOLE:
                rt->dst.output = dst_discard_out;
                rt->dst.input = dst_discard;
        case RTN_PROHIBIT:
                rt->dst.output = ip6_pkt_prohibit_out;
                rt->dst.input = ip6_pkt_prohibit;
        case RTN_THROW:
        case RTN_UNREACHABLE:
                rt->dst.output = ip6_pkt_discard_out;
                rt->dst.input = ip6_pkt_discard;

They all drop the packet with a given counter bumped.

Powered by blists - more mailing lists