From patchwork Mon Jul 8 18:15:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13726968 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f225.google.com (mail-lj1-f225.google.com [209.85.208.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80803145A14 for ; Mon, 8 Jul 2024 18:15:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462560; cv=none; b=QireWdtcPoGB0k0K1m0fIr1YmujYW4aFQv6oCdj6aA6kjYr5kVmnJsvqvWNYF2TRYU76R729gUNlnz/l3hqttZotjlNS432PLEAUjdJXz0G04NgBgssXy1VOWTmyYBggPI67LPykmooBhwFzM5cyMZpO+L1bopQUfx41rGAlNHA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462560; c=relaxed/simple; bh=zQwyXlH5ZVF5TCm9+O1XVJlW7UMrvHWYI4dVKxhljRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Eo2Fnt3hKdwtvIx8GFYFBDM7CNAyG0CF3hv9yaQC6iHAIIGvqOJEtHMBg96TQ5100h14k43LqFJQuLZrtPg4MlA7/5H0YkLBFe25zOq1dG7gDncgeZWlBCCOklx5Qzupis09FeAKvHGmsC6hTvzvQCJqfe9BXwgMkK/JeMEkAPE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=MAmAPM5Q; arc=none smtp.client-ip=209.85.208.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="MAmAPM5Q" Received: by mail-lj1-f225.google.com with SMTP id 38308e7fff4ca-2ee75ffce77so51914241fa.3 for ; Mon, 08 Jul 2024 11:15:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720462557; x=1721067357; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=dV6Uuuc+7CMJHWF96ycy0YXjsqaz4AJvsOhj3qX4WxM=; b=MAmAPM5QfEHe9avUBi6+goCNXPKYf+5BVDkj21WpxGXT6HaRQuNdIHDfGCtkS4LNMr eaUBrXkiwr7B4BbKBtpIxL6fCyBQuKDyXKbZ0VY7A3J3Lbtrz8TS9lUqAbGIHpC/q4Yx vugI2d/YFTIcoRjZmUbXVtnDma4NB2c5x585OQZhpi7efTyncH5zTTbIjyTESa4lgHPq KnIqk5QIuXGR5HgSOWxJC3zJRNn9erSGL4+wYrMS0dNpoe9UBuw4ss4jgxtGfNMpteFf 3TWr5SAywOgtvQWBjFKVPOvTCBqUXlUKm9jgtH8XzuzrfN+RWBQAz4W8AWh6aVChYMFR IV5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720462557; x=1721067357; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=dV6Uuuc+7CMJHWF96ycy0YXjsqaz4AJvsOhj3qX4WxM=; b=Wn5eGQz/Zz4dMKi8Oq9XVtZ4ANRWAGiPYbHxJtye6Y/M9SE1ljrnp5FtjZYWmyHOcR CtC0Hi9Q9+IuvayXBhXRhZ00suxTYXKMPo2BG0LxY8/1UuOysxa/Jr393HFe4H5mb1gh R628/yVOL0Xq/UyqnJxnheaToz+f9Pqty6HAEVriPn4yodd8GUfOWbAFwVpoMD+1WNoL rXlAt9PHH2hjPJVHkSPm0zMUs4aHJmn/O5LOEd5hwTnKKo2bznIyp4DKtDzuHGEypQDx 4V3a+W87FJewcvqVVYQB/kiBWgSnNRkPWs6/cDlGaJNHukQU5TfhjgEdyzgClrT9PEFN vKNQ== X-Forwarded-Encrypted: i=1; AJvYcCXJruPSMJYenyumSlFUyXNTDfFImSKs/18i+zGA7vhE2+WZjK3LR/z5anhjFfUoIqLLaKty3xxC8of/fHvVASRgJz93PHYJ X-Gm-Message-State: AOJu0YyZi/cql0GgTQYWSjyA6iMOWEHWNJWzTtIJrHhP13ajH/RYxXrs 2o4ewvL/GWg7u/BO+9ZHvsgVTiW8yOC0UGByrMQXmDFcHP1SuG2/XO8ygwDwmYGI65X8eqUr4oS 1m0SDMQW8+NOYKixYM8H0R/pEfHsYgkeF X-Google-Smtp-Source: AGHT+IF64yl9851lVilnVXaQ+AdD7M4I2+bnbnXS9xoAOv5flEQNX8j2ts7iI74lanVnsU5A9aw4NR3O9yhI X-Received: by 2002:a2e:3306:0:b0:2ee:8454:1c25 with SMTP id 38308e7fff4ca-2eeb316b020mr3937671fa.34.1720462556722; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 38308e7fff4ca-2eeb342d71dsm49451fa.20.2024.07.08.11.15.56; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 21AC760310; Mon, 8 Jul 2024 20:15:56 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sQsu3-00HP8v-PE; Mon, 08 Jul 2024 20:15:55 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v3 1/4] ipv4: fix source address selection with route leak Date: Mon, 8 Jul 2024 20:15:07 +0200 Message-ID: <20240708181554.4134673-2-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> References: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- net/ipv4/fib_semantics.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index f669da98d11d..8956026bc0a2 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -2270,6 +2270,15 @@ void fib_select_path(struct net *net, struct fib_result *res, fib_select_default(fl4, res); check_saddr: - if (!fl4->saddr) - fl4->saddr = fib_result_prefsrc(net, res); + if (!fl4->saddr) { + struct net_device *l3mdev; + + l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev); + + if (!l3mdev || + l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev) + fl4->saddr = fib_result_prefsrc(net, res); + else + fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK); + } } From patchwork Mon Jul 8 18:15:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13726969 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f226.google.com (mail-lj1-f226.google.com [209.85.208.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B76E81482E0 for ; Mon, 8 Jul 2024 18:15:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.226 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462560; cv=none; b=msZCNlHcqDVNFtH7VeOm4pkzBbrOZ+OjV1AmSIr8U2I/3VAk/jAlIHTorV0DZwjQDsrzDr5ISWvuVVlW/wVyTJkSt/sxkoMtqBxVJkEViXUBTqzkkb9WD1XAetKY2ofY+gPVtm0hgvCAl96k25+H2HGu5u5XlpdtKMyc6ETsy1U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462560; c=relaxed/simple; bh=DnDY1P9R7nc7R06ZlFBZmWwjWi9pu3p/GnwzVK4Bbks=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AsooB1YZADs9rF/NobtqZET1doyRW2l9XUWsnAGH/VqTVlyThZErDWyjSwwHKjKs4ziYUlZ23t4R8AypU/Q7dwX+PHzk9MbxilPcGhGzP4L9qBuinQntPGKK2kRzX3p2FFcP7LLHyaQZEXqpuUUylDRarMqXGVE4e5aOEWf/bQ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=cModQKmd; arc=none smtp.client-ip=209.85.208.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="cModQKmd" Received: by mail-lj1-f226.google.com with SMTP id 38308e7fff4ca-2ebe40673d8so56605791fa.3 for ; Mon, 08 Jul 2024 11:15:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720462557; x=1721067357; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=44mUTW+IybRW7geQ6WseXm5KqvYB7rwIlQGrIeQ76L0=; b=cModQKmd2dgM9twtPd9ylhhHh7ctwqCLUUCjvXJPF6PVVKE7RRuzTmHzLdLDS9IpwV JSI9uiIIaiUQI8CswzYWvzz1xMkR5NnF4xC+1NBhjN0+lkilR2HsKWyvBKatK99gMGCm K1JHnTazm1pe3hKCPP9w/HIKlhnqHIU6ZI8flm8sOzwpXYg+5qUnTfJl/PWFLAzOWu1Q vDIxEgYx3QQyhVgD5vJJEonEeU9sv3y/btnrAV03vJVbBZQunezy3HrzTyggW65v4moz znz4NFU1fMEO1gkwlmPC2cvqAZNunDoUPU1oqxGEbAFDh5G7Mvb3fc1Se7UNFp0oyCDX zK6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720462557; x=1721067357; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=44mUTW+IybRW7geQ6WseXm5KqvYB7rwIlQGrIeQ76L0=; b=n8daObVY3guS+/tJAikBm5mKuqkKm6yfcxAWkQY9ZO2eczosRk3x77CFxgidvBbOsQ llipLpI9OfP7FCvzwHRcpV7GUAXsFNZLKeLGZcEkBTP3N1SG60+Kj09owSWKoGJjGH1b 5T/6bMx5PxUlLrRQ/r4/sPW/vSDt3iijuc78lB26Qvr6KoJFsSI0HEpE5pvCZ8VEhocE 5IUl6RYuQY4Ti/tPkezartf0Sw+gW8ONtfrWrlPMqVzqsICo5e3tAKOuVchyzziGbVaS SEaKMLdHEMFiXOqZm2fnFmeDOIPBp5NOAd00EjeYLM2B4tUr/idQ9A6wXZiY1DJiatMy Y9TA== X-Forwarded-Encrypted: i=1; AJvYcCXOshrL2mld5+fgvZkbqsF8p/bZHiyBvPB2MNSaDNl++UTDhGEaEN5sXxQUwRRCFiHTPRJVG6/y2AQWTNECKy3iwRcKkzd2 X-Gm-Message-State: AOJu0YwkGhlnfX7wSfv2TW9m2P9dTrH7llQFejuIoJmqQuAYvRBqycBb 1Q0uNm0rk+r+X0AiWM0yddtHJkKhRNM/MscTR3N4xNxhhRwgMh6XU7JEsgcebGr6kvii0GVaAGY bTA7KEWdPlYDW+QaT6HyT2qNWWdMbuFBY X-Google-Smtp-Source: AGHT+IGkf0VCvYQSmdohF70R0Hk4JvCssPVxSWvsdSayojNHU/z/HE9SQ6YXRsp5J0geEq2XhU6mZySmE8jR X-Received: by 2002:a05:6512:3b1f:b0:52e:7f6b:5786 with SMTP id 2adb3069b0e04-52eb99d3dedmr87283e87.61.1720462556781; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 2adb3069b0e04-52eb9069cb5sm8018e87.106.2024.07.08.11.15.56; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 2AC8C60466; Mon, 8 Jul 2024 20:15:56 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sQsu3-00HP90-Pj; Mon, 08 Jul 2024 20:15:55 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v3 2/4] ipv6: fix source address selection with route leak Date: Mon, 8 Jul 2024 20:15:08 +0200 Message-ID: <20240708181554.4134673-3-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> References: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- include/net/ip6_route.h | 21 ++++++++++++++------- net/ipv6/ip6_output.c | 1 + net/ipv6/route.c | 2 +- 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h index a18ed24fed94..667f0a517fd0 100644 --- a/include/net/ip6_route.h +++ b/include/net/ip6_route.h @@ -127,18 +127,25 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args, static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i, const struct in6_addr *daddr, - unsigned int prefs, + unsigned int prefs, int l3mdev_index, struct in6_addr *saddr) { + struct net_device *l3mdev; + struct net_device *dev; + bool same_vrf; int err = 0; - if (f6i && f6i->fib6_prefsrc.plen) { - *saddr = f6i->fib6_prefsrc.addr; - } else { - struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL; + rcu_read_lock(); - err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr); - } + l3mdev = dev_get_by_index_rcu(net, l3mdev_index); + dev = f6i ? fib6_info_nh_dev(f6i) : NULL; + same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev; + if (f6i && f6i->fib6_prefsrc.plen && same_vrf) + *saddr = f6i->fib6_prefsrc.addr; + else + err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr); + + rcu_read_unlock(); return err; } diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 27d8725445e3..784424ac4147 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, from = rt ? rcu_dereference(rt->from) : NULL; err = ip6_route_get_saddr(net, from, &fl6->daddr, sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0, + fl6->flowi6_l3mdev, &fl6->saddr); rcu_read_unlock(); diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8d72ca0b086d..c9a9506b714d 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, goto nla_put_failure; } else if (dest) { struct in6_addr saddr_buf; - if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 && + if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 && nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf)) goto nla_put_failure; } From patchwork Mon Jul 8 18:15:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13726966 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-wm1-f98.google.com (mail-wm1-f98.google.com [209.85.128.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F028A28EF for ; Mon, 8 Jul 2024 18:15:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.98 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462559; cv=none; b=vDlwYzj2/1QSwpAQv0/pv3/Hdk9gECqtBGhSjq2JHNsTFNPMjlnUu4UW1iXifa2y3O/DZGLQ1tMpRUKx7vNqidamV1P1XRAMXOAtzNKhlLP/VxQPfF9rMd1zYfx3YiSs5p9D7j4OIJogz13RZnVSt4KfAWFEfnBQVEOyzz0lve8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462559; c=relaxed/simple; bh=ibX4c5HkiZ3iw5b7jPJhH6vG8JD5H5pnTuVXtda0FQA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=slWOHo9Yh0KCyMbhfkbVii5CJDGrga65NuwGsQ3618VC2+EEDFay/X6S4ZBTo/BAJsswvdxsSgA9m37ee8MSB16goumwjoLfXstw8Stwm4KgHFzS5IJR2FRWlFBzyiKF3VyQPID1Q5sLMs9wArYgrIbFLRscx6TYhkMt0xuNxSk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=hXRjdcdH; arc=none smtp.client-ip=209.85.128.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="hXRjdcdH" Received: by mail-wm1-f98.google.com with SMTP id 5b1f17b1804b1-4266edee10cso3418375e9.2 for ; Mon, 08 Jul 2024 11:15:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720462556; x=1721067356; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=A+/8q0n9zIZuPd8v8xe46w2FL6quvs2/a1bhvxAdF2Y=; b=hXRjdcdHmxm/tcHT0sBlC684I1RGpJA+OZtDlBl/w1Pf91zHUzaPAGpLZEA3GBX5NH mLbIbUV9QKtHy7YxrCtktnVPYPIu68DnvTFSkkfhEQCAQkpWAnr/Kvry7DL56u00ATbO zNJ0BviD6pBDuLqLjTK7sRgL+agqMfgaNSBjgTuqdrPJkWDzQj2EOxuIjrnCO66xlD/+ Rr7BExVjO56rs9/pC+zXsEp203IkmJdWwlJgzYvRRYsqOHAfB/fufoUuqJUSJzRK3oBD DV52Hvk1gbmrtchmovYS6URsE8/aTG2KmzgL6WkcKlldVQjPfdZuKFY4h+XTI9SnNala NdwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720462556; x=1721067356; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=A+/8q0n9zIZuPd8v8xe46w2FL6quvs2/a1bhvxAdF2Y=; b=VQDzAQv2l4QDUv14UWOMMTHqY3FMfFyalOE21ogi7X82kqGNKQVOInUeGe2AW0oOpc 7ax1VUj885eSi6lteB8SPZt2xhWLvxyUbObDAYt2ZDsNS6LxGqGXHryFRdTY3dHLh6hS Qucm5S9dCG07pBtJ+C9vwNpav2X3Pk9BhbguJ1pBoQqkhPWUsem82S+XEhdVB52sYp0S Yx4jeEojbgyNfmUMnqPOPO+M14e7ylaM4mRh6t2BETgwm8hapPh6KSIZO9dNMAXyI8et fvETAyRu71h4ukhtFAWSCz70X7JuQ8ZGdkqTn4RrczIPlw1oo7HN0XQYsbJCTOTa+8MG 6X+Q== X-Forwarded-Encrypted: i=1; AJvYcCXZXIFmtUmshYxL/Sjj5lIn10vUw8VWQYGEsiLkX9pTqZhG+oFU6IUjjxTHjCU3zY/iLKGFJDPosF63ScIVWhtA1M3XMnWA X-Gm-Message-State: AOJu0YzN4lZleHNL7SqZCaexkMDR2RjU8UPA3xfa9SK0W+aErWXzoN3V iJAduO1FGg3MpCxtyGR05fq3nRNBBGTiriZg2Hj/Vg0LhI8Ok4X+WD7nWLnW5epVUq0QiUhShKt S1rl4hafZt9eblg/miuGvZ133g1NP848r X-Google-Smtp-Source: AGHT+IHkqVFPGrB1oIKqijM7RNmdDYfluVmCTA+6xb+aMZ21j/vyzS0Shew3Y1jn1PyKmCvuBp0eUMLeBznj X-Received: by 2002:a05:600c:428a:b0:426:6153:5318 with SMTP id 5b1f17b1804b1-426707e209emr2482865e9.19.1720462556441; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4265f7f3a25sm2527395e9.44.2024.07.08.11.15.56; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 2869A603DB; Mon, 8 Jul 2024 20:15:56 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sQsu3-00HP93-QD; Mon, 08 Jul 2024 20:15:55 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v3 3/4] ipv6: take care of scope when choosing the src addr Date: Mon, 8 Jul 2024 20:15:09 +0200 Message-ID: <20240708181554.4134673-4-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> References: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside. CC: stable@vger.kernel.org Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5c424a0e7232..4f2c5cc31015 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, master, &dst, scores, hiscore_idx); - if (scores[hiscore_idx].ifa) + if (scores[hiscore_idx].ifa && + scores[hiscore_idx].scopedist >= 0) goto out; } From patchwork Mon Jul 8 18:15:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13726967 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-wm1-f99.google.com (mail-wm1-f99.google.com [209.85.128.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22167144D00 for ; Mon, 8 Jul 2024 18:15:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462559; cv=none; b=H9iz/EQ+eSU5iCuYKxOTwPJ59kb7Km/UMNbmHG1pN90RKVOAJu1hfLduIDU451vx/GIkEWyDnay5mxq9V5Z0vszoVV++x9Zcxx+CL46f5ex2EjgpUiN2TbUcsfUbp1yzNbWZiv+CkPNtfat/GA3Cwo3R1qncX8qUY5DiORT3rM4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720462559; c=relaxed/simple; bh=ZLlc5dosUXBwxv5EvKjhTs6jf047vphz4uaP3nIUfSQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S/s8k9Ed66l9Asq4rAVlyzJJuNUSe6/BnhrhnhqTCsbMssp/PXwxDZLDkXPZRJ7LB4j/VqMbD9ISgt/UPHH5pWcm7BMsAzgbBCh7Nza8R0208mJ9if1jDv7XRuyiSkFl1CD0AAlc1ltfoafo5Q8ycNaltIx+1ss9wNm9iqDIu7M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=eMH5OqHf; arc=none smtp.client-ip=209.85.128.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="eMH5OqHf" Received: by mail-wm1-f99.google.com with SMTP id 5b1f17b1804b1-42122ac2f38so26036535e9.1 for ; Mon, 08 Jul 2024 11:15:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720462556; x=1721067356; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=sG/y4J/BblaYD793saZe0Fjc8VN24m2nt2FOXMt7dsg=; b=eMH5OqHfUzIJKoeOWaztUc2wzOuCb272IICOvsha50ROn1B688X1gb1Unsz8kbnzub QN0Z12XvAAnSKeaK+qp27aU/3db4pP29x88HWX7GsbMDzXkeJXbzVa+fa6capeuePosH Yl4+l855nfePWM/ig2TT8p70wTF+WWtO390+nbzdjyWwTfLWqhOFPInvYBFHF8THdu12 X0pgM3YhetqMu0MGPhz/MWTaXIkZ+uVz3CCGmznDW6lHrSbS4ZyoVvmhA2/CEdMqc80w w6nn8FTCxh7omUZZLsSMR9yuM5G1qICQVDilSF770Mt6UdjRfpYaaAqX1hgi7rSHhp/7 a2qA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720462556; x=1721067356; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=sG/y4J/BblaYD793saZe0Fjc8VN24m2nt2FOXMt7dsg=; b=Hj8bEm+SSrkqRtYwlZnG2lnczSXNmrKASODqpOv7oIPHZfzADCNV1fL+bO8iTEd3Sw fr9asF/C0tAU7SLTFjJqau1TxNgIUHenoHAoO5XbvmSEA8EmUKmMcutGJfnIqXlXCZ+0 UDAR2Gupzc7xkNpRs24CfDUT4DqY3G1/jpER+iD3Ek6RBgb6cgLmdyJ2Bf6AOshOY80K Nd8cYzmDgMAAlVUF7glyigPAZ8HkIYnELik2G7YGrdQx8nWJtq7OC8KCwEb15OEKWqYV 0mUoLvJ/Pwre4CkadWiwswKsC1kldd5JLyudaPzrVQVJwRUKTZDfE4htVeo5NzvpqAKI ThJQ== X-Forwarded-Encrypted: i=1; AJvYcCWWk8oXkXmwUFzcHLWmba+4B96CpQG0aopcLZpG+kC+ycb+UfayRqmzL1y7c8OxnjYmRW5I9Ca63vfJr8BUA1UmBOmC9ZpN X-Gm-Message-State: AOJu0YykzpyLXyZkfAa3kRdIGacnVFqM+gsEC9SJcRnDT2KBnKUIt3cd At3GjrONXUR1MCfVKSsXOa7qtMnXqfd6D+e9n4TJQb47QyBX174A1XtoBnuQR2S++5fn5u3kEH1 SY5iynjRjTMDUjHzub2C3+J1fs0C/IglR X-Google-Smtp-Source: AGHT+IEzMVRnNhdxX1pKuysa0tGwumrv1w6J7vPbp4c7PXcsUC7fN01zGTEVX295pd7qRCieqO9+jKnkxE5k X-Received: by 2002:a05:600c:4487:b0:426:5cc7:82f with SMTP id 5b1f17b1804b1-42672305c06mr71505e9.13.1720462556477; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4264a1f2283sm4360295e9.23.2024.07.08.11.15.56; Mon, 08 Jul 2024 11:15:56 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 2D9246047E; Mon, 8 Jul 2024 20:15:56 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sQsu3-00HP96-Qk; Mon, 08 Jul 2024 20:15:55 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel Subject: [PATCH net v3 4/4] selftests: vrf_route_leaking: add local test Date: Mon, 8 Jul 2024 20:15:10 +0200 Message-ID: <20240708181554.4134673-5-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> References: <20240708181554.4134673-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The goal is to check that the source address selected by the kernel is routable when a leaking route is used. ICMP, TCP and UDP connections are tested. The symmetric topology is enough for this test. Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- .../selftests/net/vrf_route_leaking.sh | 93 ++++++++++++++++++- 1 file changed, 91 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/vrf_route_leaking.sh b/tools/testing/selftests/net/vrf_route_leaking.sh index 2da32f4c479b..152171fb1fc8 100755 --- a/tools/testing/selftests/net/vrf_route_leaking.sh +++ b/tools/testing/selftests/net/vrf_route_leaking.sh @@ -59,6 +59,7 @@ # while it is forwarded between different vrfs. source lib.sh +PATH=$PWD:$PWD/tools/testing/selftests/net:$PATH VERBOSE=0 PAUSE_ON_FAIL=no DEFAULT_TTYPE=sym @@ -533,6 +534,86 @@ ipv6_ping_frag_asym() ipv6_ping_frag asym } +ipv4_ping_local() +{ + log_section "IPv4 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity || return + + run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP} + log_test $? 0 "VRF ICMP local IPv4" +} + +ipv4_tcp_local() +{ + log_section "IPv4 (sym route): VRF tcp local connection" + + setup_sym + + check_connectivity || return + + run_cmd nettest -s -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -N "$r1" -d blue -r ${H2_N2_IP} + log_test $? 0 "VRF tcp local connection IPv4" +} + +ipv4_udp_local() +{ + log_section "IPv4 (sym route): VRF udp local connection" + + setup_sym + + check_connectivity || return + + run_cmd nettest -s -D -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -D -N "$r1" -d blue -r ${H2_N2_IP} + log_test $? 0 "VRF udp local connection IPv4" +} + +ipv6_ping_local() +{ + log_section "IPv6 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity6 || return + + run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6} + log_test $? 0 "VRF ICMP local IPv6" +} + +ipv6_tcp_local() +{ + log_section "IPv6 (sym route): VRF tcp local connection" + + setup_sym + + check_connectivity6 || return + + run_cmd nettest -s -6 -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -6 -N "$r1" -d blue -r ${H2_N2_IP6} + log_test $? 0 "VRF tcp local connection IPv6" +} + +ipv6_udp_local() +{ + log_section "IPv6 (sym route): VRF udp local connection" + + setup_sym + + check_connectivity6 || return + + run_cmd nettest -s -6 -D -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -6 -D -N "$r1" -d blue -r ${H2_N2_IP6} + log_test $? 0 "VRF udp local connection IPv6" +} + ################################################################################ # usage @@ -555,8 +636,10 @@ EOF # Some systems don't have a ping6 binary anymore command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping) -TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym" -TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym" +TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_tcp_local +ipv4_udp_local ipv4_ping_ttl_asym ipv4_traceroute_asym" +TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_tcp_local ipv6_udp_local +ipv6_ping_ttl_asym ipv6_traceroute_asym" ret=0 nsuccess=0 @@ -594,12 +677,18 @@ do ipv4_traceroute|traceroute) ipv4_traceroute;;& ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;& ipv4_ping_frag|ping) ipv4_ping_frag;;& + ipv4_ping_local|ping) ipv4_ping_local;;& + ipv4_tcp_local) ipv4_tcp_local;;& + ipv4_udp_local) ipv4_udp_local;;& ipv6_ping_ttl|ping) ipv6_ping_ttl;;& ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;& ipv6_traceroute|traceroute) ipv6_traceroute;;& ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;& ipv6_ping_frag|ping) ipv6_ping_frag;;& + ipv6_ping_local|ping) ipv6_ping_local;;& + ipv6_tcp_local) ipv6_tcp_local;;& + ipv6_udp_local) ipv6_udp_local;;& # setup namespaces and config, but do not run any tests setup_sym|setup) setup_sym; exit 0;;