netdev - Re: [PATCH net] ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANP3RGeckq1hiiFvXZ1m7hozSUc5S=qLmsL7xnk1Bts_vbGNWg@mail.gmail.com>
Date: Wed, 12 Jul 2023 15:58:43 +0200
From: Maciej Żenczykowski <zenczykowski@...il.com>
To: Maciej Żenczykowski <zenczykowski@...il.com>
Cc: Linux Network Development Mailing List <netdev@...r.kernel.org>, "David S. Miller" <davem@...emloft.net>, 
	David Ahern <dsahern@...nel.org>, Jiri Pirko <jiri@...nulli.us>, Xiao Ma <xiaom@...gle.com>
Subject: Re: [PATCH net] ipv6 addrconf: fix bug where deleting a mngtmpaddr
 can create a new temporary address

On Wed, Jul 12, 2023 at 3:55 PM Maciej Żenczykowski <maze@...gle.com> wrote:
> currently on 6.4 net/main:
>
>   # ip link add dummy1 type dummy
>   # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr
>   # ip link set dummy1 up
>   # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1
>   # ip -6 addr show dev dummy1
>
>   11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
>       inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic
>          valid_lft 604800sec preferred_lft 86172sec
>       inet6 2000::1/64 scope global mngtmpaddr
>          valid_lft forever preferred_lft forever
>       inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
>          valid_lft forever preferred_lft forever
>
>   # ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1
>
>   (can wait a few seconds if you want to, the above delete isn't [directly] the problem)
>
>   # ip -6 addr show dev dummy1
>
>   11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
>       inet6 2000::1/64 scope global mngtmpaddr
>          valid_lft forever preferred_lft forever
>       inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
>          valid_lft forever preferred_lft forever
>
>   # ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1
>   # ip -6 addr show dev dummy1
>
>   11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
>       inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic
>          valid_lft 604797sec preferred_lft 86169sec
>       inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
>          valid_lft forever preferred_lft forever
>
> This patch prevents this new 'global temporary dynamic' address from being
> created by the deletion of the related (same subnet prefix) 'mngtmpaddr'
> (which is triggered by there already being no temporary addresses).
>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: David Ahern <dsahern@...nel.org>
> Cc: Jiri Pirko <jiri@...nulli.us>
> Fixes: 53bd67491537 ("ipv6 addrconf: introduce IFA_F_MANAGETEMPADDR to tell kernel to manage temporary addresses")
> Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
> ---
>  net/ipv6/addrconf.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index e5213e598a04..94cec2075eee 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -2561,12 +2561,18 @@ static void manage_tempaddrs(struct inet6_dev *idev,
>                         ipv6_ifa_notify(0, ift);
>         }
>
> -       if ((create || list_empty(&idev->tempaddr_list)) &&
> -           idev->cnf.use_tempaddr > 0) {
> +       /* Also create a temporary address if it's enabled but no temporary
> +        * address currently exists.
> +        * However, we get called with valid_lft == 0, prefered_lft == 0, create == false
> +        * as part of cleanup (ie. deleting the mngtmpaddr).
> +        * We don't want that to result in creating a new temporary ip address.
> +        */
> +       if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft))
> +               create = true;
> +
> +       if (create && idev->cnf.use_tempaddr > 0) {
>                 /* When a new public address is created as described
>                  * in [ADDRCONF], also create a new temporary address.
> -                * Also create a temporary address if it's enabled but
> -                * no temporary address currently exists.
>                  */
>                 read_unlock_bh(&idev->lock);
>                 ipv6_create_tempaddr(ifp, false);
> --
> 2.41.0.255.g8b1d071c50-goog
>

eh, should have included:

Reported-by: Xiao Ma <xiaom@...gle.com>