From patchwork Wed Jul 10 08:14:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13728991 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lf1-f99.google.com (mail-lf1-f99.google.com [209.85.167.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0E4284D29 for ; Wed, 10 Jul 2024 08:15:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; cv=none; b=Jfs0vSRnf32LR7bNZXJbzm/BOgjRWYpFdWPSCZVoJGibr7UNJhBt/XgkiC0BA5pOm0dosragzKHlP5fSWi3GGL/j7+/1ELk2ZeNafMgnao2NbQtQ1AKVd5aWo/xNxsRDCvisrEzx6Gz48hXpJVHky74fdS39YiqCGwIOB/HjizI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; c=relaxed/simple; bh=L9cYX0FZOqsEWUS6Dl4jXBnuh+p+V+nVGgMuCjsSSHY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V4yEJzuiWAITxyJ1DlU9lLCmgMV+UL8ixUBsa82Kgoh4YYuoUzHQS7Q/Vg6/AOx0+otWdQmMIpdBKxzixbznkd0W/PatddiUwJDBDwkB5cxS2CgAAOweFE7ITckIXxU7kT39BcSll5nnBSIXE3PJ6WmzKJDYlpJcrz3pPVTMupM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=DnXLFb9h; arc=none smtp.client-ip=209.85.167.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="DnXLFb9h" Received: by mail-lf1-f99.google.com with SMTP id 2adb3069b0e04-52ea5dc3c66so8517410e87.3 for ; Wed, 10 Jul 2024 01:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720599324; x=1721204124; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=vHfy2kRUgaVp+I9p+R/nnBTbFpFOafOVt67JpL5cYvA=; b=DnXLFb9hPzDzRKcgU99mfhzZSYxsMYGUzKisZIt7nrzvimLnw38chgqDdyh9cCGgFN FUSMf6HM27LEZ7ICZoFxyhb4S1gXwN9FMTaWsME6AWPLWFPeTyw+WCduODLnqRWuevnt D+MmyInXNi/E5ZfhiedGhWpZu5YQIFj7QHrvoijcWz/5mON+MI3dBCBv6fuO2efF5oXn ezbMr5BV5L1cXQ9ix3Goi8DGEZUDts6ZHwPCzvldKjewHXJjpZQZJ2rupD7CnBFgHi4s TzrqwVOxUjJv2cfb74F+WiG9yTOZQLtb7rTrGCt5DKLQ0eArxImE3kfbIxrkYp2sVejw dm6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720599324; x=1721204124; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vHfy2kRUgaVp+I9p+R/nnBTbFpFOafOVt67JpL5cYvA=; b=ZqIlYFzQZeXW9bQwtllIb2c0SUtJBNNhsgxFUzBjZnhu5Xvi4+QBF3G1c+2aqB4g+x VaMJxJVffSAVRv+bexE7BGkbyqkTtk+Ncj53JTQAeyS9/86d+0axBL1dpj5MmFWkMi7U 5y0aJr3BSWXQPyJYSLVscJy/3PisO6O4TVmN6oU5iVx3W6VRC25DnWunbYPHZDzMaIR7 7+xv3ou4LkpmM7+k3Nl+1zfCB3UANzYQ+LUTRsX4uhS16tnaxjlPL5L9bOFJwmG9OWKs LTGo/R20BRTGxy6Ed7m2K/ap4rAp7FvgyAIdtlHdBp2grvE3SUuY7TqnxSnmbKtVy9KX pdew== X-Forwarded-Encrypted: i=1; AJvYcCUePM/Kfl9NaHA7IoHLQPLznkT2ZpzBe9kxV9yiTR6i6/o9zAHDiRumwfa8uPYlosqWc+Pxvft082q1cuB7J593MABlu0yr X-Gm-Message-State: AOJu0YwPDFBedh4geMp3Qft6/MOXaCCnA9ak9VnC0+JUG3LAtBgTTSYd ZdE8GRoPapYFV9X9wmVIwf0bi1cPCEPI6taWRomqT9WM4kMtLXcDxLNH08MnGRXxkMospX1a2z1 5AQdT9mVnWtfMnf88iFTaOBuilQJP0fZS X-Google-Smtp-Source: AGHT+IHtfnocm4ldsA4+yF3b0rhj3hqvP8B6rA8W27iPtRI7FPGB+HWm8fxx1/B2ysSk2iRIP5gO/ySptU45 X-Received: by 2002:a05:6512:3b90:b0:52c:76ac:329b with SMTP id 2adb3069b0e04-52eb99a35dfmr3905436e87.35.1720599323983; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id a640c23a62f3a-a780a8535a1sm694966b.224.2024.07.10.01.15.23; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 8228560117; Wed, 10 Jul 2024 10:15:23 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sRSTz-00Fz6w-7h; Wed, 10 Jul 2024 10:15:23 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v4 1/4] ipv4: fix source address selection with route leak Date: Wed, 10 Jul 2024 10:14:27 +0200 Message-ID: <20240710081521.3809742-2-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> References: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- net/ipv4/fib_semantics.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index f669da98d11d..8956026bc0a2 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -2270,6 +2270,15 @@ void fib_select_path(struct net *net, struct fib_result *res, fib_select_default(fl4, res); check_saddr: - if (!fl4->saddr) - fl4->saddr = fib_result_prefsrc(net, res); + if (!fl4->saddr) { + struct net_device *l3mdev; + + l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev); + + if (!l3mdev || + l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev) + fl4->saddr = fib_result_prefsrc(net, res); + else + fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK); + } } From patchwork Wed Jul 10 08:14:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13728988 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-wm1-f99.google.com (mail-wm1-f99.google.com [209.85.128.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3FF842076 for ; Wed, 10 Jul 2024 08:15:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; cv=none; b=f4gxgVEwCYn50IeF8t5otRQ4FP6MY333mY1/dQXUrtXOOkCfeRA5VUZClXZ2fR4qzYmtheq9LKyKQWLNRrwpmexa6Rp9IClVN2cvUgAvxbOJ01i0Dq5Bwh289n7SMcjae51LQ16imrgniOJsn9mow/ENCmgPpAzJAHzFV9CUmLE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; c=relaxed/simple; bh=WZApNyTcpnq80ps4e5r7dxC8IiIumlq5ELs8f32jb+w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Gi/HOFPb71NKKf1FhVoeH5GVYcqveomWmeSN5tAIuROAfxJPoJtK87c6ZUCEhLHRFYz9LUaSQ2+72U+53n1lQyxTh7LHM4dkIZLzzHi6xxAFzjxgMYqDKOfynA1aarNlf2yNEoZHkSNJu45gcNv2mtn8n3imTr4d874h+QQee7k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=a/P6/amg; arc=none smtp.client-ip=209.85.128.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="a/P6/amg" Received: by mail-wm1-f99.google.com with SMTP id 5b1f17b1804b1-4277a5ed48bso4904375e9.2 for ; Wed, 10 Jul 2024 01:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720599324; x=1721204124; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9Y/N5FajcPj742c7WgLRR706htS9YsQC2raVIyjDgLk=; b=a/P6/amgG07erx4NuisTBbFDjSQj+v7Hzcb/70xK4pKRAmeBQeac6y60wz9ysUt73G tdrfloy7da5zIxOqLkZoccXeR0DAy1J6xLMLOFOBqSEsUdW6NAKNsCsVxQR5crZ5FWRv CzhhoefMZxTnPJcZfprAuBjwLIubAg24K/4GpevUaHwf6MNmU6UIkyi1mEIO2wlUVrLL AjjVmLuVQXlXz1DqHswS5vBoAyPRx0xTlHmAgMeiIdyDQPuedk7rUyGCfm+tp2gZhIQu BQEecCoNnMGYert0qQfNGABz7wCqTfYJGwx88gaIeI6pdEWOiD+NGn1li+kMqWXFndHb pQ1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720599324; x=1721204124; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9Y/N5FajcPj742c7WgLRR706htS9YsQC2raVIyjDgLk=; b=sysOtLbsJEAZHr3A6MU6G7AwlA8b4AIDeBo9v6/wghJjDq8I3OoqnAkUFm3npzDBn4 LvKjQ/xDS6lIG8f9897U38km9Cul6HqX+boFtNgYovld/q/7+tgNkucgcrZqlzTyiQ0y wmFl9ewTzr7O9CgbcnotYqP6wBbF3doU39jUXGuzBfviTKFYxQADqMMa9woKa+AMZOkb yhS/CZkCyhE0hfmVIo5m27evJ8YdOMB+p2YiXIZf4quKusDOLkCPoRlNxPzzjIESFjqB swM4zLslO72VIEpXsamWJUA++ZWupfGt5emft5+FJ49Y8xun0XblXPhshkx1Ui1meA+I mj+Q== X-Forwarded-Encrypted: i=1; AJvYcCU4UUGf77Vf+gPTJhJ2YL6R4RR37/KeLN/pHnSaWqVWNAaioLpW2EcB17iarVIKhN0E+UJefVMgH8OHMoUq+eGTcZfDtPwI X-Gm-Message-State: AOJu0YwU/M+P0GFSoxPpTt0fmwF5T7zBm5Pc3gBAfl9FgeU5CL9LWLlg SER3dA7RECjqTDoyMwxSJrcUBXrG55t/5NxIFXJgeDWIdNerCfakkf+kx0oMReY1R8UwUmc6zdO MlmFZrQq2tZArz7G23DXbc/PdmvuX3kkT X-Google-Smtp-Source: AGHT+IEUCpL4kst+YlcjK8la07ODZird0pOyMgL1T9uX8wzg5oFEVx9Ynk5A95G0GXH+zUvQo4Z1dhY6W5Ln X-Received: by 2002:a7b:cd1a:0:b0:426:4f47:6037 with SMTP id 5b1f17b1804b1-426707d7914mr30021045e9.19.1720599324008; Wed, 10 Jul 2024 01:15:24 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4279554c9d6sm239865e9.15.2024.07.10.01.15.23; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 8C633602B0; Wed, 10 Jul 2024 10:15:23 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sRSTz-00Fz6z-8G; Wed, 10 Jul 2024 10:15:23 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v4 2/4] ipv6: fix source address selection with route leak Date: Wed, 10 Jul 2024 10:14:28 +0200 Message-ID: <20240710081521.3809742-3-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> References: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6") Signed-off-by: Nicolas Dichtel --- include/net/ip6_route.h | 22 +++++++++++++++------- net/ipv6/ip6_output.c | 1 + net/ipv6/route.c | 2 +- 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h index a18ed24fed94..6dbdf60b342f 100644 --- a/include/net/ip6_route.h +++ b/include/net/ip6_route.h @@ -127,18 +127,26 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args, static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i, const struct in6_addr *daddr, - unsigned int prefs, + unsigned int prefs, int l3mdev_index, struct in6_addr *saddr) { + struct net_device *l3mdev; + struct net_device *dev; + bool same_vrf; int err = 0; - if (f6i && f6i->fib6_prefsrc.plen) { - *saddr = f6i->fib6_prefsrc.addr; - } else { - struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL; + rcu_read_lock(); - err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr); - } + l3mdev = dev_get_by_index_rcu(net, l3mdev_index); + if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev) + dev = f6i ? fib6_info_nh_dev(f6i) : NULL; + same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev; + if (f6i && f6i->fib6_prefsrc.plen && same_vrf) + *saddr = f6i->fib6_prefsrc.addr; + else + err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr); + + rcu_read_unlock(); return err; } diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 27d8725445e3..784424ac4147 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, from = rt ? rcu_dereference(rt->from) : NULL; err = ip6_route_get_saddr(net, from, &fl6->daddr, sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0, + fl6->flowi6_l3mdev, &fl6->saddr); rcu_read_unlock(); diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8d72ca0b086d..c9a9506b714d 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, goto nla_put_failure; } else if (dest) { struct in6_addr saddr_buf; - if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 && + if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 && nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf)) goto nla_put_failure; } From patchwork Wed Jul 10 08:14:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13728992 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ej1-f97.google.com (mail-ej1-f97.google.com [209.85.218.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B469D5464A for ; Wed, 10 Jul 2024 08:15:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.97 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; cv=none; b=Rafc/KlH4tQ61/VVRZnFbkKBrIo751SUcHOubdavuEON5O13m4WxuP1q4wM1kiNkBk7QK+LcANxyYuaGijyUXqS0dZ8wbjcocbhkaOZYQohAWQ1Fmw4VYsoA+ZxV6IIIB8nmoPvtupBUNDmtdM53C2FnM7ZKSsQHnMzYAJwFcuE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; c=relaxed/simple; bh=ibX4c5HkiZ3iw5b7jPJhH6vG8JD5H5pnTuVXtda0FQA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ePNfsj37lsC8xzErgkzueuaIAInY7LIdGsZGrk+zeRzCH0VEDRQpvKmfK8vDqzy68ZHIaMr+Q80qh6avOx2tg3B63U8etwCcbxReksnD4HjPmfYP9ZNAcLH83L7UR7GEqJBBIn617ftNi4mtwrkxks46j2iicagbcls0WpFaaSM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=T/metDuA; arc=none smtp.client-ip=209.85.218.97 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="T/metDuA" Received: by mail-ej1-f97.google.com with SMTP id a640c23a62f3a-a77bf336171so103121366b.1 for ; Wed, 10 Jul 2024 01:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720599324; x=1721204124; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=A+/8q0n9zIZuPd8v8xe46w2FL6quvs2/a1bhvxAdF2Y=; b=T/metDuAkdYsaCBjHaBokk/YlHcnYu5CvlQzpOP7OCfeyKkqhNDkvJWf2AWHa0vkxv 3hKis11NwAwgJ0AgPGlQ89okk0faJluhfQXzhZVHxQZKH6L0VeKJrzj2DepUB4HcPOZz UAtNL7QYBxW6cApA+aSCEP2cIxu5EhYtNa6QZK8ifaJQbob1WojsA6w6OVDw+ieHVfd5 gZ+O8K4h+Bgenz0axGti4Mgf0TPGamAZC4KDMgFBgX2zBMs5Qv+lf4SXBR5vfQ5BE2U0 1moePgBzxAdvE0GFKsYdBaWTmo1oPnznenpTo04NmY2w6otMNugH9c7dtu2gtNOTfdRA +jug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720599324; x=1721204124; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=A+/8q0n9zIZuPd8v8xe46w2FL6quvs2/a1bhvxAdF2Y=; b=FAvdW7Ue78H3X2DH3X+IvRg/w1pbjqQL1zQJ+p6eamOtmdPARkth2Ii5wRA/+164lL MGz4TDqqczrmFk+QNzwvhSZop5GGTIcmNbhiJGOJWfyrKjWJSoYNK2SKWXex5ZF2PxlT wI3vM0XmFkrMA5yT0LJKyeTxo7PTOV/8zEk9AfwdD55XLZzu4/onLeb1+SXbLLAfLNIs wuHbigPNH7FhCzus1cSGpN02OG0IiK60PKH9AhLp+8oCc9R9hozEXkHZxwM5gUOeqtwM fth0d14kiPrhPB5NUXHXdCfbskbziZAD8xBnwr1MR0PGtt7X9czh0AIrqa2xYjFX8+F8 duWg== X-Forwarded-Encrypted: i=1; AJvYcCXnelfUUHh5XvrZP2oOlHwUr5Z0IYICl5e/uyIKBppUbVBnCt2HV8x14nQaBjJn+mbDudPgO4FjBtQzbYxHD52i6HxXUFB7 X-Gm-Message-State: AOJu0YxE8KioFqfJQomKDsSJrxmNuw4YcR+j+HWmk+oSuIQFk7T5TT1F 2tHsLhSDiQy6cEuum9jccGj9PK51soSsJDozgDFoVhQzssdF2ZXX791pEb/z5F+QTQsshrukhAU wkyNmMH/jkl3R1OXA15Zd+ILdQJPkBbU9 X-Google-Smtp-Source: AGHT+IFsldb2fu9x0xbmMVclMdscPmCxu5if7Io4zRFog8YBq09ulvZ48ZpidT+5sDJQbv+HPV2iFLgMWMoi X-Received: by 2002:a17:906:4e89:b0:a77:d40e:7b2a with SMTP id a640c23a62f3a-a780d3f441fmr250384766b.37.1720599323967; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id a640c23a62f3a-a780a6dc788sm632466b.101.2024.07.10.01.15.23; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 8E6FA60466; Wed, 10 Jul 2024 10:15:23 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sRSTz-00Fz72-8k; Wed, 10 Jul 2024 10:15:23 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v4 3/4] ipv6: take care of scope when choosing the src addr Date: Wed, 10 Jul 2024 10:14:29 +0200 Message-ID: <20240710081521.3809742-4-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> References: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside. CC: stable@vger.kernel.org Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5c424a0e7232..4f2c5cc31015 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, master, &dst, scores, hiscore_idx); - if (scores[hiscore_idx].ifa) + if (scores[hiscore_idx].ifa && + scores[hiscore_idx].scopedist >= 0) goto out; } From patchwork Wed Jul 10 08:14:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13728990 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ed1-f99.google.com (mail-ed1-f99.google.com [209.85.208.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B68C38287E for ; Wed, 10 Jul 2024 08:15:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; cv=none; b=lT3gkCdRIilSCxACeITrPt9e8if5K+cCEsKFTRuBRE8qxnuVN8k9WjNHB3ZjyAL7TZRr5ZenMgIy56JaYYPoAe/FBhmDFZ/YmYj+TtZDVQOGCQTC/NlHJpt0XytnhzpKjVZ6a9tzFOKzQGZ4l+Mz9i76hXZSUxqkm8rMBuImhqw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720599327; c=relaxed/simple; bh=1JzfSMHUDYGHzQLy8AlMX+aaizG8MdTX6YEZHk00ckE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U6Qv2XKXvQ/ByTyoyrFjDV6HqdfhY0tR2pvGI1OoC9olvMYTpKyxScawnKApuHsWw6wGUM0eKDiTmnrCehfpxVMRmqbjo/jKDVgYQoBhqYA4QImBnTGPa1uD8KkWh0TTNPk/cpiiWOjPEqaEySNUe1wHj5LAB5dSc9Twuj+Vd2g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=Sjhw1Bny; arc=none smtp.client-ip=209.85.208.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="Sjhw1Bny" Received: by mail-ed1-f99.google.com with SMTP id 4fb4d7f45d1cf-58c2e5e8649so868218a12.1 for ; Wed, 10 Jul 2024 01:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720599324; x=1721204124; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=AE5Dx4qup9WtpzmHI/wzoD5SSmj6JOH4d2YLtDw7nBQ=; b=Sjhw1BnyUMImW4M1a3Yfr71ZSECD1inSDYPZNDDwkLzUpEe5w2AJ97eFpQuEqKYBKn nId4YzyZcRPJe79pDHiR27hZA95NWU8DtKRQarT+JMCNqJ3PdDcFz8hdfwnGMqU9k3ls a8boC8J856pOfSpTxRyLsvqIv96uCVYabY27TKX5AiSoK+kEsLyHWZrOew4fK4A/PjY7 xfY8cAAlT14+xlhrni2llIzoMAeDwk7CqhMt8cP33XCouHTNZou7HQoJ7Uz1cFLFF4Il E/cwflf1DcgGt+1d2tdBzAB4sMeQYF+YcUcNGh04CYIU6ftOudicqHEtmlbkwqtrolZp zASQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720599324; x=1721204124; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=AE5Dx4qup9WtpzmHI/wzoD5SSmj6JOH4d2YLtDw7nBQ=; b=Wwy5LELYsqNUHrmQes5Uxcxxau6TjE83WFt9nGTOjCStu2g9+m4jARFvIR90tzCaot L2bkTTcKOiwbtd4u1mrpx3T6LqsN7p0Yug6dt2UzVO8zIRFJVS7fYgdqn/ZerZ1V+wqi P0pGWJs9iYVJAK6A0CTDBmRzbghkqKOOSn6YrwR0qXTl8fdsAnlMw3DJT2lbnCXL5twL 13YGuNbAu2bV4GckcGuzmgiJhmEwF492W3W9AueGsKQBbFGRoFAJ0P/39hGcNaOWcR1w MJNHgwwIi63hKnmCB2BzKGZBC0Qp5kwNmlrUphtqgSI5yvznisy9vbWZLZK2FnruRgse e1ng== X-Forwarded-Encrypted: i=1; AJvYcCUeXqMpBI7FXImqIutgltlX68ompzv9Icuo0yUrx0P8YsbsboQc0cRFqYD7qXKPdnYG1k+TPRfNqQUitl2bBiZshCkqwxCM X-Gm-Message-State: AOJu0YwNVr28nOEKV/fryvDb22/JQyqyzFfws8KKOmr1p+/EXUQyeNll zvfIzD33ou2H+QuLYjwJhFtOdb1LMYqDaXJxdvUvwXJsXekKk/6+6YUnnCh68T7ZnBVeO1viEIB sV4/VPXiLVOwKhs1SpjJGid6dedUhS39T X-Google-Smtp-Source: AGHT+IHN2DiWCkYusAIPa1JSTEHycI+A+8qxR4Dg716keCPFslHPmvd6aKnmLgt3kfBkd3wPijvKlR7UvqXd X-Received: by 2002:a05:6402:696:b0:595:7779:1f7 with SMTP id 4fb4d7f45d1cf-5957779030cmr2730557a12.16.1720599324002; Wed, 10 Jul 2024 01:15:24 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 4fb4d7f45d1cf-594bba54bebsm54406a12.3.2024.07.10.01.15.23; Wed, 10 Jul 2024 01:15:23 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id 941C96047E; Wed, 10 Jul 2024 10:15:23 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sRSTz-00Fz75-9L; Wed, 10 Jul 2024 10:15:23 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel Subject: [PATCH net v4 4/4] selftests: vrf_route_leaking: add local test Date: Wed, 10 Jul 2024 10:14:30 +0200 Message-ID: <20240710081521.3809742-5-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> References: <20240710081521.3809742-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The goal is to check that the source address selected by the kernel is routable when a leaking route is used. ICMP, TCP and UDP connections are tested. The symmetric topology is enough for this test. Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- .../selftests/net/vrf_route_leaking.sh | 93 ++++++++++++++++++- 1 file changed, 91 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/vrf_route_leaking.sh b/tools/testing/selftests/net/vrf_route_leaking.sh index 2da32f4c479b..152171fb1fc8 100755 --- a/tools/testing/selftests/net/vrf_route_leaking.sh +++ b/tools/testing/selftests/net/vrf_route_leaking.sh @@ -59,6 +59,7 @@ # while it is forwarded between different vrfs. source lib.sh +PATH=$PWD:$PWD/tools/testing/selftests/net:$PATH VERBOSE=0 PAUSE_ON_FAIL=no DEFAULT_TTYPE=sym @@ -533,6 +534,86 @@ ipv6_ping_frag_asym() ipv6_ping_frag asym } +ipv4_ping_local() +{ + log_section "IPv4 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity || return + + run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP} + log_test $? 0 "VRF ICMP local IPv4" +} + +ipv4_tcp_local() +{ + log_section "IPv4 (sym route): VRF tcp local connection" + + setup_sym + + check_connectivity || return + + run_cmd nettest -s -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -N "$r1" -d blue -r ${H2_N2_IP} + log_test $? 0 "VRF tcp local connection IPv4" +} + +ipv4_udp_local() +{ + log_section "IPv4 (sym route): VRF udp local connection" + + setup_sym + + check_connectivity || return + + run_cmd nettest -s -D -O "$h2" -l ${H2_N2_IP} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -D -N "$r1" -d blue -r ${H2_N2_IP} + log_test $? 0 "VRF udp local connection IPv4" +} + +ipv6_ping_local() +{ + log_section "IPv6 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity6 || return + + run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6} + log_test $? 0 "VRF ICMP local IPv6" +} + +ipv6_tcp_local() +{ + log_section "IPv6 (sym route): VRF tcp local connection" + + setup_sym + + check_connectivity6 || return + + run_cmd nettest -s -6 -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -6 -N "$r1" -d blue -r ${H2_N2_IP6} + log_test $? 0 "VRF tcp local connection IPv6" +} + +ipv6_udp_local() +{ + log_section "IPv6 (sym route): VRF udp local connection" + + setup_sym + + check_connectivity6 || return + + run_cmd nettest -s -6 -D -O "$h2" -l ${H2_N2_IP6} -I eth0 -3 eth0 & + sleep 1 + run_cmd nettest -6 -D -N "$r1" -d blue -r ${H2_N2_IP6} + log_test $? 0 "VRF udp local connection IPv6" +} + ################################################################################ # usage @@ -555,8 +636,10 @@ EOF # Some systems don't have a ping6 binary anymore command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping) -TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym" -TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym" +TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_tcp_local +ipv4_udp_local ipv4_ping_ttl_asym ipv4_traceroute_asym" +TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_tcp_local ipv6_udp_local +ipv6_ping_ttl_asym ipv6_traceroute_asym" ret=0 nsuccess=0 @@ -594,12 +677,18 @@ do ipv4_traceroute|traceroute) ipv4_traceroute;;& ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;& ipv4_ping_frag|ping) ipv4_ping_frag;;& + ipv4_ping_local|ping) ipv4_ping_local;;& + ipv4_tcp_local) ipv4_tcp_local;;& + ipv4_udp_local) ipv4_udp_local;;& ipv6_ping_ttl|ping) ipv6_ping_ttl;;& ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;& ipv6_traceroute|traceroute) ipv6_traceroute;;& ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;& ipv6_ping_frag|ping) ipv6_ping_frag;;& + ipv6_ping_local|ping) ipv6_ping_local;;& + ipv6_tcp_local) ipv6_tcp_local;;& + ipv6_udp_local) ipv6_udp_local;;& # setup namespaces and config, but do not run any tests setup_sym|setup) setup_sym; exit 0;;