| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251210113745.145c55825034b2fe98522860@uniroma2.it>
Date: Wed, 10 Dec 2025 11:37:45 +0100
From: Andrea Mayer <andrea.mayer@...roma2.it>
To: Nicolas Dichtel <nicolas.dichtel@...nd.com>
Cc: "David S . Miller" <davem@...emloft.net>,
Jakub Kicinski
<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Eric Dumazet
<edumazet@...gle.com>,
David Lebrun <david.lebrun@...ouvain.be>,
Paolo
Lungaroni <paolo.lungaroni@...roma2.it>,
David Ahern <dsahern@...nel.org>, netdev@...r.kernel.org,
stefano.salsano@...roma2.it, Andrea Mayer
<andrea.mayer@...roma2.it>
Subject: Re: [PATCH net] seg6: fix route leak for encap routes
On Mon, 8 Dec 2025 11:24:34 +0100
Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:
> The goal is to take into account the device used to set up the route.
> Before this commit, it was mandatory but ignored. After encapsulation, a
> second route lookup is performed using the encapsulated IPv6 address.
> This route lookup is now done in the vrf where the route device is set.
>
Hi Nicolas,
I've got your point. However, I'm still concerned about the implications of
using the *dev* field in the root lookup. This field has been ignored for this
purpose so far, so some existing configurations/scripts may need to be adapted
to work again. The adjustments made to the self-tests below show what might
happen.
> The l3vpn tests show the inconsistency; they are updated to reflect the
> fix. Before the commit, the route to 'fc00:21:100::6046' was put in the
> vrf-100 table while the encap route was pointing to veth0, which is not
> associated with a vrf.
>
> Before:
> > $ ip -n rt_2-Rh5GP7 -6 r list vrf vrf-100 | grep fc00:21:100::6046
> > cafe::1 encap seg6 mode encap segs 1 [ fc00:21:100::6046 ] dev veth0 metric 1024 pref medium
> > fc00:21:100::6046 via fd00::1 dev veth0 metric 1024 pref medium
>
> After:
> > $ ip -n rt_2-Rh5GP7 -6 r list vrf vrf-100 | grep fc00:21:100::6046
> > cafe::1 encap seg6 mode encap segs 1 [ fc00:21:100::6046 ] dev veth0 metric 1024 pref medium
> > $ ip -n rt_2-Rh5GP7 -6 r list | grep fc00:21:100::6046
> > fc00:21:100::6046 via fd00::1 dev veth0 metric 1024 pref medium
>
> Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
> ---
> net/ipv6/seg6_iptunnel.c | 6 ++++++
> tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh | 2 +-
> tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh | 2 +-
> tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh | 2 +-
> 4 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
> index 3e1b9991131a..9535aea28357 100644
> --- a/net/ipv6/seg6_iptunnel.c
> +++ b/net/ipv6/seg6_iptunnel.c
> @@ -484,6 +484,12 @@ static int seg6_input_core(struct net *net, struct sock *sk,
> * now and use it later as a comparison.
> */
> lwtst = orig_dst->lwtstate;
> + if (orig_dst->dev) {
When can 'orig_dst->dev' be NULL in this context?
> + rcu_read_lock();
> + skb->dev = l3mdev_master_dev_rcu(orig_dst->dev) ?:
> + dev_net(skb->dev)->loopback_dev;
> + rcu_read_unlock();
> + }
>
> slwt = seg6_lwt_lwtunnel(lwtst);
>
> diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> index a5e959a080bb..682fb5b4509d 100755
> --- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> @@ -333,7 +333,7 @@ setup_vpn_config()
> encap seg6 mode encap segs ${vpn_sid} dev veth0
> ip -netns ${rtsrc_name} -4 route add ${IPv4_HS_NETWORK}.${hsdst}/32 vrf vrf-${tid} \
> encap seg6 mode encap segs ${vpn_sid} dev veth0
> - ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 vrf vrf-${tid} \
> + ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 \
> via fd00::${rtdst} dev veth0
>
> # set the decap route for decapsulating packets which arrive from
> diff --git a/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh
> index a649dba3cb77..11f693c65169 100755
> --- a/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh
> @@ -287,7 +287,7 @@ setup_vpn_config()
> # host hssrc and destined to the access router rtsrc.
> ip -netns ${rtsrc_name} -4 route add ${IPv4_HS_NETWORK}.${hsdst}/32 vrf vrf-${tid} \
> encap seg6 mode encap segs ${vpn_sid} dev veth0
> - ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 vrf vrf-${tid} \
> + ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 \
> via fd00::${rtdst} dev veth0
>
> # set the decap route for decapsulating packets which arrive from
> diff --git a/tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh
> index e408406d8489..7d7e056c645c 100755
> --- a/tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh
> @@ -297,7 +297,7 @@ setup_vpn_config()
> # host hssrc and destined to the access router rtsrc.
> ip -netns ${rtsrc_name} -6 route add ${IPv6_HS_NETWORK}::${hsdst}/128 vrf vrf-${tid} \
> encap seg6 mode encap segs ${vpn_sid} dev veth0
> - ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 vrf vrf-${tid} \
> + ip -netns ${rtsrc_name} -6 route add ${vpn_sid}/128 \
> via fd00::${rtdst} dev veth0
>
> # set the decap route for decapsulating packets which arrive from
> --
> 2.47.1
>
Thanks,
Andrea
Powered by blists - more mailing lists