netdev - Re: [PATCH] net: ipv6: fix the address length for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z2KphccLReKzJxwZ@emanuele-archlinux>
Date: Wed, 18 Dec 2024 11:52:53 +0100
From: Emanuele Santini <emanuele.santini.88@...il.com>
To: Guillaume Nault <gnault@...hat.com>
Cc: netdev@...r.kernel.org, yoshfuji@...ux-ipv6.org, friedrich@...age.de,
	kuba@...nel.org, davem@...emloft.net, pabeni@...hat.com,
	dsahern@...nel.org
Subject: Re: [PATCH] net: ipv6: fix the address length for net_device on a
 GRE tunnel

On Fri, Nov 08, 2024 at 05:17:12PM +0100, Guillaume Nault wrote:
> On Fri, Nov 08, 2024 at 03:24:03PM +0100, Emanuele Santini wrote:
> > I'm talking about the ip6gre. I agree that setting the hardware address to 0 is appropriate.
> > However, in the ip6gre_tunnel_setup function, the perm_addr field of net_device is 
> > currently assigned a random Ethernet address:
> > 
> >         dev->flags |= IFF_NOARP;
> >        - dev->addr_len = sizeof(struct in6_addr);
> >        + dev->addr_len = ETH_ALEN;
> >         netif_keep_dst(dev);
> >         /* This perm addr will be used as interface identifier by IPv6 */
> >         dev->addr_assign_type = NET_ADDR_RANDOM;
> >         eth_random_addr(dev->perm_addr);
> > 
> > maybe this is not a valid justification to set addr_len to ETH_ALEN.
> 
> I think that having a fake permanent address for the purpose of IPv6
> interface Id. generation isn't a correct justification for setting
> dev->addr_len.
> 
> If setting ->perm_addr and ->addr_assign_type have side effects on the
> acceptable values of ->addr_len, then the commit description should
> explain that in more details.
> 
> > I will make a review setting addr_len to 0, and will resubmit the patch after successful testing.
> 
> Thanks.
>

The addr_len field in the net_device structure of the IP6GRE tunnel is set to the IPv6 address length
because the 'ip6gre_tunnel_init' function in 'net/ip6_gre.c' initializes the hardware address using the
tunnel’s local and remote network addresses:


>	__dev_addr_set(dev, &tunnel->parms.laddr, sizeof(struct in6_addr));
>	memcpy(dev->broadcast, &tunnel->parms.raddr, sizeof(struct in6_addr));


Additionally, I found the following comment in the 'add_v4_addrs' function in 'net/addrconf.c':

>   /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */
>   if (idev->dev->addr_len == sizeof(struct in6_addr))

This indicates that the 'addr_len' field in 'net_device' is intentionally set to an IPv6 length, even
though it may not be appropriate.

However, this behavior triggers an unusual bug with packet sockets: when attempting to use sendto on an
IPv6 GRE tunnel, the call fails with an "Invalid Argument" error.

However, modifying the addr_len field might not be the best approach to resolve this bug. So, consider
this patch closed.

Thanks.