netdev - Re: [PATCH net-next,v3 05/12] gtp: use IPv6 address /64 prefix for UE/MS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240509121557.GO1736038@kernel.org>
Date: Thu, 9 May 2024 13:15:57 +0100
From: Simon Horman <horms@...nel.org>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
	pabeni@...hat.com, edumazet@...gle.com, laforge@...ocom.org,
	pespin@...mocom.de, osmith@...mocom.de
Subject: Re: [PATCH net-next,v3 05/12] gtp: use IPv6 address /64 prefix for
 UE/MS

On Tue, May 07, 2024 at 01:52:44AM +0200, Pablo Neira Ayuso wrote:
> Harald Welte reports that according to 3GPP TS 29.060:
> 
>     PDN Connection: the association between a MS represented by one IPv4
> address and/or one IPv6 prefix and a PDN represented by an APN.
> 
> this clearly states that IPv4 is a single address while IPv6 is a single prefix.
> 
> Then, 3GPP TS 29.061, Section 11.2.1.3:
> 
>     For APNs that are configured for IPv6 address allocation, the GGSN/P-GW
> shall only use the Prefix part of the IPv6 address for forwarding of mobile
> terminated IP packets. The size of the prefix shall be according to the maximum
> prefix length for a global IPv6 address as specified in the IPv6 Addressing
> Architecture, see RFC 4291 [82].
> 
> RFC 4291 section 2.5.4 states
> 
>     All Global Unicast addresses other than those that start with binary 000
> have a 64-bit interface ID field (i.e., n + m = 64) ...
> 
> 3GPP TS 29.61 Section 11.2.1.3.2a:
> 
>     In the procedure in the cases of using GTP-based S5/S8, P-GW acts as an
> access router, and allocates to a UE a globally unique /64 IPv6 prefix if the
> PLMN allocates the prefix.
> 
> Therefore, compare IPv6 address /64 prefix only since MS/UE is not a single
> address like in the IPv4 case.
> 
> Reject IPv6 address with EADDRNOTAVAIL if it lower 64 bits of the IPv6 address
> from the control plane are set.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>

Reviewed-by: Simon Horman <horms@...nel.org>