lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 31 Mar 2022 09:13:10 +0000 From: "Pudak, Filip" <Filip.Pudak@...driver.com> To: David Ahern <dsahern@...nel.org>, "Xiao, Jiguang" <Jiguang.Xiao@...driver.com>, "davem@...emloft.net" <davem@...emloft.net>, "yoshfuji@...ux-ipv6.org" <yoshfuji@...ux-ipv6.org>, "kuba@...nel.org" <kuba@...nel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Subject: RE: This counter "ip6InNoRoutes" does not follow the RFC4293 specification implementation Hi David, So we end up in ip6_pkt_discard -> ip6_pkt_drop : --- if (netif_is_l3_master(skb->dev) && dst->dev == net->loopback_dev) idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif)); else idev = ip6_dst_idev(dst); switch (ipstats_mib_noroutes) { case IPSTATS_MIB_INNOROUTES: type = ipv6_addr_type(&ipv6_hdr(skb)->daddr); if (type == IPV6_ADDR_ANY) { IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS); break; } fallthrough; case IPSTATS_MIB_OUTNOROUTES: IP6_INC_STATS(net, idev, ipstats_mib_noroutes); break; } --- What happens in the case where the l3mdev is not used, is that we go into the else branch(idev = ip6_dst_idev(dst);) and then we can see that the counter is incremented on the loopback IF. So is the only option that l3mdev should be used or is it strange to expect that the idev where the INNOROUTES should increment is the ingress device by default in this case? Best Regards, Filip Pudak -----Original Message----- From: David Ahern <dsahern@...nel.org> Sent: Wednesday, 9 March 2022 05:50 To: Xiao, Jiguang <Jiguang.Xiao@...driver.com>; davem@...emloft.net; yoshfuji@...ux-ipv6.org; kuba@...nel.org; netdev@...r.kernel.org; linux-kernel@...r.kernel.org Cc: Pudak, Filip <Filip.Pudak@...driver.com> Subject: Re: This counter "ip6InNoRoutes" does not follow the RFC4293 specification implementation On 3/8/22 7:16 PM, Xiao, Jiguang wrote: > Hi David > > To confirm whether my test method is correct, could you please briefly describe your test procedure? > > > no formal test. Code analysis (ip6_pkt_discard{,_out} -> ip6_pkt_drop) shows the counters that should be incrementing and then looking at the counters on a local server. FIB Lookup failures should generate a dst with one of these handlers: static void ip6_rt_init_dst_reject(struct rt6_info *rt, u8 fib6_type) { rt->dst.error = ip6_rt_type_to_error(fib6_type); switch (fib6_type) { case RTN_BLACKHOLE: rt->dst.output = dst_discard_out; rt->dst.input = dst_discard; break; case RTN_PROHIBIT: rt->dst.output = ip6_pkt_prohibit_out; rt->dst.input = ip6_pkt_prohibit; break; case RTN_THROW: case RTN_UNREACHABLE: default: rt->dst.output = ip6_pkt_discard_out; rt->dst.input = ip6_pkt_discard; break; } } They all drop the packet with a given counter bumped.
Powered by blists - more mailing lists