| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <14c03971406de4effc9cf2ef21cf3921bd8b662d.1714982035.git.antony.antony@secunet.com>
Date: Mon, 6 May 2024 10:00:40 +0200
From: Antony Antony <antony.antony@...unet.com>
To: Jakub Kicinski <kuba@...nel.org>, Steffen Klassert
<steffen.klassert@...unet.com>, <netdev@...r.kernel.org>,
<linux-kselftest@...r.kernel.org>
CC: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>,
Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, "Herbert
Xu" <herbert@...dor.apana.org.au>, Antony Antony <antony.antony@...unet.com>,
Shuah Khan <shuah@...nel.org>, <devel@...ux-ipsec.org>
Subject: [PATCH net-next v3 1/2] xfrm: fix source address in icmp error
generation from IPsec gateway
When enabling support for XFRM lookup using reverse ICMP payload, we
have identified an issue where the source address of the IPv4,
e.g., "Destination Host Unreachable" message, is incorrect. The error message
received by the sender appears to originate from a
non-existing/unreachable host. IPv6 seems to behave correctly; respond
with an existing source address from the gateway.
Here is example of incorrect source address for ICMP error response.
When sending a ping to an unreachable host, the sender would receive an
ICMP unreachable response with a fake source address. Rather the address
of the host that generated ICMP Unreachable message. This is confusing
and incorrect. A fllow up commit adds this example as a test case.
Example:
ping -W 9 -w 5 -c 1 10.1.4.3
PING 10.1.4.3 (10.1.4.3) 56(84) bytes of data.
>From 10.1.4.3 icmp_seq=1 Destination Host Unreachable
Notice : packet has the source address of the ICMP "Unreachable host!"
This issue can be traced back to commit
415b3334a21a ("icmp: Fix regression in nexthop resolution during replies.")
which introduced a change that copied the source address from the ICMP
payload.
This commit would force to use source address from the gatway/host.
The ICMP error message source address correctly set from the host.
After fixing:
ping -W 5 -c 1 10.1.4.3
PING 10.1.4.3 (10.1.4.3) 56(84) bytes of data.
>From 10.1.3.2 icmp_seq=1 Destination Host Unreachable
Here is an snippt to reporduce the issue.
export AB="10.1"
for i in 1 2 3 4 5; do
h="host${i}"
ip netns add ${h}
ip -netns ${h} link set lo up
ip netns exec ${h} sysctl -wq net.ipv4.ip_forward=1
if [ $i -lt 5 ]; then
ip -netns ${h} link add eth0 type veth peer name eth10${i}
ip -netns ${h} addr add "${AB}.${i}.1/24" dev eth0
ip -netns ${h} link set up dev eth0
fi
done
for i in 1 2 3 4 5; do
h="host${i}"
p=$((i - 1))
ph="host${p}"
# connect to previous host
if [ $i -gt 1 ]; then
ip -netns ${ph} link set eth10${p} netns ${h}
ip -netns ${h} link set eth10${p} name eth1
ip -netns ${h} link set up dev eth1
ip -netns ${h} addr add "${AB}.${p}.2/24" dev eth1
fi
# add forward routes
for k in $(seq ${i} $((5 - 1))); do
ip -netns ${h} route 2>/dev/null | (grep "${AB}.${k}.0" 2>/dev/null) || \
ip -netns ${h} route add "${AB}.${k}.0/24" via "${AB}.${i}.2" 2>/dev/nul
done
# add reverse routes
for k in $(seq 1 $((i - 2))); do
ip -netns ${h} route 2>/dev/null | grep "${AB}.${k}.0" 2>/dev/null || \
ip -netns ${h} route add "${AB}.${k}.0/24" via "${AB}.${p}.1" 2>/dev/nul
done
done
ip netns exec host1 ping -q -W 2 -w 1 -c 1 10.1.4.2 2>&1>/dev/null && echo "success 10.1.4.2 reachable" || echo "ERROR"
ip netns exec host1 ping -W 9 -w 5 -c 1 10.1.4.3 || echo "note the source address of unreachble of gateway"
ip -netns host1 route flush cache
ip netns exec host3 nft add table inet filter
ip netns exec host3 nft add chain inet filter FORWARD { type filter hook forward priority filter\; policy drop \; }
ip netns exec host3 nft add rule inet filter FORWARD counter ip protocol icmp drop
ip netns exec host3 nft add rule inet filter FORWARD counter ip protocol esp accept
ip netns exec host3 nft add rule inet filter FORWARD counter drop
ip -netns host2 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir out \
flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 1 mode tunnel
ip -netns host2 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir in \
tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 2 mode tunnel
ip -netns host2 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir fwd \
flag icmp tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 2 mode tunnel
ip -netns host2 xfrm state add src 10.1.2.1 dst 10.1.3.2 proto esp spi 1 \
reqid 1 replay-window 1 mode tunnel aead 'rfc4106(gcm(aes))' \
0x1111111111111111111111111111111111111111 96 \
sel src 10.1.1.0/24 dst 10.1.4.0/24
ip -netns host2 xfrm state add src 10.1.3.2 dst 10.1.2.1 proto esp spi 2 \
flag icmp reqid 2 replay-window 10 mode tunnel aead 'rfc4106(gcm(aes))' \
0x2222222222222222222222222222222222222222 96
ip -netns host4 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir out \
flag icmp tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 1 mode tunnel
ip -netns host4 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir in \
tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 2 mode tunnel
ip -netns host4 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir fwd \
flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 2 mode tunnel
ip -netns host4 xfrm state add src 10.1.3.2 dst 10.1.2.1 proto esp spi 2 \
reqid 1 replay-window 1 mode tunnel aead 'rfc4106(gcm(aes))' \
0x2222222222222222222222222222222222222222 96
ip -netns host4 xfrm state add src 10.1.2.1 dst 10.1.3.2 proto esp spi 1 \
reqid 2 replay-window 20 flag icmp mode tunnel aead 'rfc4106(gcm(aes))' \
0x1111111111111111111111111111111111111111 96 \
sel src 10.1.1.0/24 dst 10.1.4.0/24
ip netns exec host1 ping -W 5 -c 1 10.1.4.2 2>&1 > /dev/null && echo ""
ip netns exec host1 ping -W 5 -c 1 10.1.4.3 || echo "note source address of gateway 10.1.3.2"
Again before the fix
ping -W 5 -c 1 10.1.4.3
>From 10.1.4.3 icmp_seq=1 Destination Host Unreachable
After the fix
>From 10.1.3.2 icmp_seq=1 Destination Host Unreachable
Signed-off-by: Antony Antony <antony.antony@...unet.com>
Acked-by: Tobias Brunner <tobias@...ongswan.org>
---
net/ipv4/icmp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 207482d30dc7..317ad5165408 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -558,7 +558,6 @@ static struct rtable *icmp_route_lookup(struct net *net,
rt2 = dst_rtable(dst2);
if (!IS_ERR(dst2)) {
dst_release(&rt->dst);
- memcpy(fl4, &fl4_dec, sizeof(*fl4));
rt = rt2;
} else if (PTR_ERR(dst2) == -EPERM) {
if (rt)
--
2.30.2
Powered by blists - more mailing lists