netdev - Re: [PATCHv3 net] ipv6: do not match device when remove source route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZLk0/f82LfebI5OR@shredder>
Date: Thu, 20 Jul 2023 16:22:05 +0300
From: Ido Schimmel <idosch@...sch.org>
To: Hangbin Liu <liuhangbin@...il.com>
Cc: netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Thomas Haller <thaller@...hat.com>
Subject: Re: [PATCHv3 net] ipv6: do not match device when remove source route

On Thu, Jul 20, 2023 at 02:59:41PM +0800, Hangbin Liu wrote:
> After deleting an IPv6 address on an interface and cleaning up the
> related preferred source entries, it is important to ensure that all
> routes associated with the deleted address are properly cleared. The
> current implementation of rt6_remove_prefsrc() only checks the preferred
> source addresses bound to the current device. However, there may be
> routes that are bound to other devices but still utilize the same
> preferred source address.
> 
> To address this issue, it is necessary to also delete entries that are
> bound to other interfaces but share the same source address with the
> current device. Failure to delete these entries would leave routes that
> are bound to the deleted address unclear. Here is an example reproducer
> (I have omitted unrelated routes):

[...]

> Ido notified that there is a commit 5a56a0b3a45d ("net: Don't delete
> routes in different VRFs") to not affect the route in different VRFs.
> So let's remove the rt dev checking and add an table id checking.
> Also remove the !rt-nh checking to clear the IPv6 routes that are using
> a nexthop object. This would be consistent with IPv4.
> 
> A ipv6_del_addr test is added for fib_tests.sh. Note that instead
> of removing the whole route for IPv4, IPv6 only remove the preferred
> source address for source routing. So in the testing use
> "grep -q src $src_ipv6_address" instead of "grep -q $dst_ipv6_subnet/64"
> when checking if the source route deleted.
> 
> Here is the fib_tests.sh ipv6_del_addr test result.

[...]

> 
> Reported-by: Thomas Haller <thaller@...hat.com>
> Fixes: c3968a857a6b ("ipv6: RTA_PREFSRC support for ipv6 route source address selection")
> Signed-off-by: Hangbin Liu <liuhangbin@...il.com>

Reviewed-by: Ido Schimmel <idosch@...dia.com>

One nit below

[...]

> @@ -1869,6 +1869,96 @@ ipv4_del_addr_test()
>  	cleanup
>  }
>  
> +ipv6_del_addr_test()
> +{

[...]

> +}
> +
>  

Double blank line