netdev - Re: [PATCH net v3 2/4] ipv6: fix source address selection with route leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ae54143a-a990-4e7e-90fd-1940cadec4c7@kernel.org>
Date: Mon, 8 Jul 2024 21:09:33 -0600
From: David Ahern <dsahern@...nel.org>
To: Nicolas Dichtel <nicolas.dichtel@...nd.com>,
 "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>
Cc: netdev@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH net v3 2/4] ipv6: fix source address selection with route
 leak

On 7/8/24 12:15 PM, Nicolas Dichtel wrote:
> By default, an address assigned to the output interface is selected when
> the source address is not specified. This is problematic when a route,
> configured in a vrf, uses an interface from another vrf (aka route leak).
> The original vrf does not own the selected source address.
> 
> Let's add a check against the output interface and call the appropriate
> function to select the source address.
> 
> CC: stable@...r.kernel.org
> Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
> ---
>  include/net/ip6_route.h | 21 ++++++++++++++-------
>  net/ipv6/ip6_output.c   |  1 +
>  net/ipv6/route.c        |  2 +-
>  3 files changed, 16 insertions(+), 8 deletions(-)
> 
> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
> index a18ed24fed94..667f0a517fd0 100644
> --- a/include/net/ip6_route.h
> +++ b/include/net/ip6_route.h
> @@ -127,18 +127,25 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
>  
>  static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
>  				      const struct in6_addr *daddr,
> -				      unsigned int prefs,
> +				      unsigned int prefs, int l3mdev_index,
>  				      struct in6_addr *saddr)
>  {
> +	struct net_device *l3mdev;
> +	struct net_device *dev;
> +	bool same_vrf;
>  	int err = 0;
>  
> -	if (f6i && f6i->fib6_prefsrc.plen) {
> -		*saddr = f6i->fib6_prefsrc.addr;
> -	} else {
> -		struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
> +	rcu_read_lock();
>  
> -		err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
> -	}
> +	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
> +	dev = f6i ? fib6_info_nh_dev(f6i) : NULL;

dev is only needed in the branch and you are now setting all the time.

> +	same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
> +	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
> +		*saddr = f6i->fib6_prefsrc.addr;
> +	else
> +		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
> +
> +	rcu_read_unlock();
>  
>  	return err;
>  }

Reviewed-by: David Ahern <dsahern@...nel.org>