From patchwork Fri Jul 5 14:52:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13725221 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-wm1-f99.google.com (mail-wm1-f99.google.com [209.85.128.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F11FC154C18 for ; Fri, 5 Jul 2024 14:53:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; cv=none; b=CcHMJhrS3BTSDQmGvo3q/1QBu/sE71u4FxZ9rMeACAY6CQXvYUW9s3wMs1QOrhCsCcTWJsQcXhfB1J8dJ2beN2Dh+YHPqC9kC+Yh9qIAXYKi8Dxev2ouFoXUOnADmwu1ADHRFuu8j4O94XxAY/ADzkcbMtNNmWhqaqlUAGYLrr0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; c=relaxed/simple; bh=F18MNQqMgi2s1pXAA8VazUOW/a2/fCiXeYMprACDpHo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Y7tnr8VN0a9GhFbfl8zaQt7vr7YXh35TPb37lFht4d5roaD08eWw4BVx6+ZngwCCrtsv6gwBE1oJWvfZl+JrCrN514eyRbgsSguZ6hoiemnM6/QZJS2DMpjYuNFaZLXDHkmk8NVKMEC4kxbCOxhAr+gu8bq4sxuexrf9bVysZT4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=encaNi7G; arc=none smtp.client-ip=209.85.128.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="encaNi7G" Received: by mail-wm1-f99.google.com with SMTP id 5b1f17b1804b1-426526d3051so5726555e9.1 for ; Fri, 05 Jul 2024 07:53:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720191184; x=1720795984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Cua0A6GEdu0iOk0GUptHeWMm27awSaljV0LV/Qv+59A=; b=encaNi7GOlrKYBKwmzrvXcrkPfMLu2jnNRiVKRM2Eh71Q8u08shElZhWMePgZjyzCH 6I/+GoyWJqTOU+rm1RRhdCSiOKhPUqXKPvnN2hm8/mgmI5LwLMnvFw7G34ZxM6GjRti4 rr5POLDD5uZfr3STibRKCwC98e1E0ZxsHQH0LqnoNnpZHrl9DSn1U8F79gfsmcpPMicp HKn/JuH591G7kCdouYw5PGsBVmFPa3mFhxaAtG05c7mSZBAHNe2BIWgETwtREy2iwY2i ZUTKPhm4RZLaRDl+N5cDbCmbO46SQ9bwswvlxgcf7aaFua5YBBK7m/S0vNgtHaJcb/jf 2q1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720191184; x=1720795984; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Cua0A6GEdu0iOk0GUptHeWMm27awSaljV0LV/Qv+59A=; b=AP3tht09T3TiPU2GC592huA9tGR5+opG16G5ck/NPDnLH1c5ESVeHPXIM0IL7hzemX 1a7gZr7JhqVmPTV4ETUYJWGaiBuV7Nq0mCxmGkEjgSvwFNVHriyT+dAZKU9obv6EfNQ3 AQeMJAdN+yC2yvHi85NNAxAZyfwUImdfWMH+GzZHTigS8szvjMkwWemMyM70aP422/GD TjvyF4OtRfURYe48++Px5reID2OJCS9Z+tbZPpk2SJRX1l25LJu/sGe8rOuCevup8zKU PyhONIjyw7BQKzG2wMmdSZokeRZJ7bgXzLKCIfeGQd0wdjH8eDwyvQ8vUyd3cd2bNT7L Clhg== X-Forwarded-Encrypted: i=1; AJvYcCUh2OluFC3pUFYEAf8Ln5/0bI+dsyietACqGtFGOVFXXW9Oxbek6h3RdEi1+ctXpDJKIrm5Zb0FJrnqmcGfu0jdlHAWvGB7 X-Gm-Message-State: AOJu0Yy2DiALgidW0fzB1H5p2aERfr/UlUJiAP9w5LBtK0my/NecjsL+ Wm7BSkcuCzMfmlPXeMJX4lOwnau2RTWRQ1NF0hobolhec+cCf+VFdrEQnLh8h8Q9LU3Vq21GuS4 S7zrKYUBupuP29/BVQL2AxEJ9NYepzfq5 X-Google-Smtp-Source: AGHT+IH9MttpwefKxSrmvypAnuQVniG8F6vZL0IbtrTqPdUBDTZbEsd+LavOwor5RyVYzU89haCcdqOITvr1 X-Received: by 2002:a1c:4c15:0:b0:425:5f73:e2e1 with SMTP id 5b1f17b1804b1-4264a3d9500mr42617415e9.22.1720191184117; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4264a2fc94esm1385335e9.47.2024.07.05.07.53.03; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id CD86C602FC; Fri, 5 Jul 2024 16:53:03 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sPkJ5-007Cqg-H2; Fri, 05 Jul 2024 16:53:03 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v2 1/4] ipv4: fix source address selection with route leak Date: Fri, 5 Jul 2024 16:52:12 +0200 Message-ID: <20240705145302.1717632-2-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> References: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF") Signed-off-by: Nicolas Dichtel --- net/ipv4/fib_semantics.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index f669da98d11d..459082f4936d 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -2270,6 +2270,13 @@ void fib_select_path(struct net *net, struct fib_result *res, fib_select_default(fl4, res); check_saddr: - if (!fl4->saddr) - fl4->saddr = fib_result_prefsrc(net, res); + if (!fl4->saddr) { + struct net_device *l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev); + + if (!l3mdev || + l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev) + fl4->saddr = fib_result_prefsrc(net, res); + else + fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK); + } } From patchwork Fri Jul 5 14:52:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13725219 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-wr1-f100.google.com (mail-wr1-f100.google.com [209.85.221.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1D291BC43 for ; Fri, 5 Jul 2024 14:53:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; cv=none; b=Bx4u+S4yltIIwzkWqBp2qpN08HPjF4dPfi2pOs4WyPrAPEJ7rOejyVVG0OJnXVMk6aBYilcWd1KJX/BDHw/YNiVfYh0Y75DFT7T7RPmq4Qu9Sl/Tk3XXpjLBtsvvA33VShdUKh1Y0woDyKcZDvyg8RVjm8WqH9hm066vgo94XWA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; c=relaxed/simple; bh=KPuaZpd8ZJ0HSSdikT2sPrbPLojsEUP1W+x8ZsaZVHU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZfBHbrqj7B8j3vxpHwUFxXPYjlIkuxmywKz0SVu1fJZvuVJCg3/txMcvdB4W40qvIrF6XX+SkCO7rWXjT7A6JuNYX9u22U4uCZiB/YUDSncRz440Spi4IO0V1DRcMaHKF5mZo8OgGE1qRe5fzjIdFcKtVSBsfdnmO9E5cJagLbk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=bY6A1wAo; arc=none smtp.client-ip=209.85.221.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="bY6A1wAo" Received: by mail-wr1-f100.google.com with SMTP id ffacd0b85a97d-3679e9bfb08so1005923f8f.1 for ; Fri, 05 Jul 2024 07:53:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720191184; x=1720795984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Na5Lj3E4Abq+eDT2imOsy9+2Ynrb8boxONyEAkQz6mk=; b=bY6A1wAo5vLsFbn95r/9R1wvPPq7sYY/0uea+O3RrGOEXTVFKPslp4hZmZMqhickKP tTG0d/pBwU2N6bpE4WmJ6qjI2npS68YbwR8ywiwiE0VOpXZma8xKzOQCh/nuxRHlY79e nJd5xNaTYhXh9eGN2QHzX+2txTJET1DsURFMKqhQEB2owslPFUdZqPbTV2EeVy7HDSTJ 2eY2gkTnvSCkOWGF7z90/0y4MElW9Kds1ZejpFc0IHPCGqSoqcylbP8kC6+3JfqDmlB/ 1ek0T03VdUXv8ym8nZhH83iIk/tn65GbzPOhfkZ1ybU5UYYbp6PO4yD9XGh/8+JpYlCo NLAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720191184; x=1720795984; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Na5Lj3E4Abq+eDT2imOsy9+2Ynrb8boxONyEAkQz6mk=; b=l5RiDL8yXFML9orklLPI/Bo8FCqFXnAdLKQJHZYvvFPoqDkTRegCpUFWI/1r5yDrcK pNpBwKhmVlUYaxlp58k73UWXxltH0m6NvXnkWpKNKUCz4p9LEIav0NNeY6eVQcl7vTjF Z5oaX5ns7FrHcMoGXVKuRZ7HigyMxBIdqjkUWCCLCz9/LB5vsyt8IwnY4lEAF2IsKMfR DiX1RI/G67U0wSfoBmX8KhQQmgZoXh2d787zItputRll2YLjFBGA4buETt8JHhsii2MA 0ww96KrsCyztZzfQ/5rjkqoUik0p6xOp4tGzjPA+pxfgJ70OcgCMKODHKdBCyWkVqp29 xwFQ== X-Forwarded-Encrypted: i=1; AJvYcCURWfmH294ed+HF2kCUvVssOO4cFF4/XU6CzgecKfbWiLQjz42lK3B54buBoW+YVRidiKu5r6rlJEeUhBqTdmEb/qhx8IiB X-Gm-Message-State: AOJu0YxmryRwWzlE7eTOK8D16YplsfcA0pcFth7GckkTiVPNWlhYxszp Qj0aU0jQyXyIQD+XurhSEBVYiYZehG0oQTAkccEI5x1IQzCW3QFJhDaJm8eHosGt9cuJh9sPcmr htrE6IQO4DfOPUp2rPpSdxtCkWV4JiVrS X-Google-Smtp-Source: AGHT+IG3rWEKH598/OdyXI4YCQApiejblsEBfLU4wMmifT2aA56lwMgBrxtwOCBYzRKpeblPHwK0ouqyK12Y X-Received: by 2002:adf:f9cf:0:b0:366:ea4a:17ec with SMTP id ffacd0b85a97d-3679f6c5b81mr4981583f8f.2.1720191184145; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4264a1d60afsm1377375e9.4.2024.07.05.07.53.03; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id D264F603EF; Fri, 5 Jul 2024 16:53:03 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sPkJ5-007Cqj-Hi; Fri, 05 Jul 2024 16:53:03 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v2 2/4] ipv6: fix source address selection with route leak Date: Fri, 5 Jul 2024 16:52:13 +0200 Message-ID: <20240705145302.1717632-3-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> References: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6") Signed-off-by: Nicolas Dichtel --- include/net/ip6_route.h | 19 ++++++++++++------- net/ipv6/ip6_output.c | 1 + net/ipv6/route.c | 2 +- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h index a18ed24fed94..a7c27f0c6bce 100644 --- a/include/net/ip6_route.h +++ b/include/net/ip6_route.h @@ -127,18 +127,23 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args, static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i, const struct in6_addr *daddr, - unsigned int prefs, + unsigned int prefs, int l3mdev_index, struct in6_addr *saddr) { + struct net_device *l3mdev; + struct net_device *dev; + bool same_vrf; int err = 0; - if (f6i && f6i->fib6_prefsrc.plen) { + rcu_read_lock(); + l3mdev = dev_get_by_index_rcu(net, l3mdev_index); + dev = f6i ? fib6_info_nh_dev(f6i) : NULL; + same_vrf = l3mdev == NULL || l3mdev_master_dev_rcu(dev) == l3mdev; + if (f6i && f6i->fib6_prefsrc.plen && same_vrf) *saddr = f6i->fib6_prefsrc.addr; - } else { - struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL; - - err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr); - } + else + err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr); + rcu_read_unlock(); return err; } diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 27d8725445e3..784424ac4147 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, from = rt ? rcu_dereference(rt->from) : NULL; err = ip6_route_get_saddr(net, from, &fl6->daddr, sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0, + fl6->flowi6_l3mdev, &fl6->saddr); rcu_read_unlock(); diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8d72ca0b086d..c9a9506b714d 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, goto nla_put_failure; } else if (dest) { struct in6_addr saddr_buf; - if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 && + if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 && nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf)) goto nla_put_failure; } From patchwork Fri Jul 5 14:52:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13725222 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f228.google.com (mail-lj1-f228.google.com [209.85.208.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 335F716A93F for ; Fri, 5 Jul 2024 14:53:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.228 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; cv=none; b=tJ9FRJ7udDk56SXTiOaU3R24T4jnGDXn4Jiu7f33AaC68fSa4UNAPspHd8aHpiX+QzEWNMBAAN6xxmz6Fk4tKHfjDaAUNZYMnwzZ1mFVXV3j2VKekdKwRDM/iBcfpYAoIvzZwCqhVrO2rYsWNDYjaWZym4FcXpqyYFli1QoTR2A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191187; c=relaxed/simple; bh=YnwMFx7v27V6FYvekKLIctK4MfTa3mGutFv4M3UNWRA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uU3GKC44nN38XBBy3Hgs6uP2T3+KFUd6V5+k78OApMyaZUdOPVlwAn/XwiUB/XamyS0MNPmqI7MgQtc9DVYaGKyh/VekI88b7GQ69DFsBC4vxPzcqlr5lPAlEA+ksb3WCk3mQj8XBtZUiQBkooRr29JMwnTiCeIkoz5CKxtnlG4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=MiDoomCe; arc=none smtp.client-ip=209.85.208.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="MiDoomCe" Received: by mail-lj1-f228.google.com with SMTP id 38308e7fff4ca-2ee4ae13aabso17992801fa.2 for ; Fri, 05 Jul 2024 07:53:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720191184; x=1720795984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LdqEoEJ0Pf4lgGIH6ji9Pz/3++dxBfiK/h/sDIFPHrE=; b=MiDoomCel6w9+aRHVNVbTfORc3gy3a82JHaZynw9/DJaJWN6lNRerFWtG9mEcSM24X 6IcZBJPFAYrTqGQ/W+rwmtjbbh+e3PxMYHFbG767gqej7Ehn2bXP64RA4a72kjKSKOIK bEkDyzCUkEdZseV5KLe1iti0/6muZxpF6omx5IgUj9Iea6HPrndskXjbymiBvQdHhzBY pdbXk0ZniYRyIFBHLIYNWI0nNq+MUIZ+EfAfRfUhB/DmQczABBFP7IBOdN9yANIPebEj Pju+6bbE/9bI6Nw5wETaY6JKJHptrAfUQmFf1qH5IjguNU4RkXaW6gDqQ3h1N+RcRJqN tMpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720191184; x=1720795984; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LdqEoEJ0Pf4lgGIH6ji9Pz/3++dxBfiK/h/sDIFPHrE=; b=rEIPP8KFCjzYVVGsZu1jrBXVLkbPsLVNTtbwl3TrMk7U0Xdaajjf7n76jo+SqogsWM RkZf3ujuGS0STBynOonGlxHxLuoNv50zdW6OTfmz9Ed+4bUdsSc/Kw3eWrwyr+3GY/bu 1+QUNNke2kX3OJ5Vgnln2bvN+GN1EOWeRK572kHgRc9XA23S3wkLXSb4voXV9D7tUioL xmDLxpYAVhifAR/hTVgiS39fbvese+ar/N5EsFl0qK2dfsaFFvjDvzspV1La76NWpmSf 1gmxFAOom0FvbcxD7dxQpiv4scHfR9v0trdsI7qeSf8p5vix59B7fT1bueBiPCb7FDnS +9tg== X-Forwarded-Encrypted: i=1; AJvYcCUEL3/xs25ZdWfEbCBKZpJFKNyKq0ZK6YBZqqMH8ZENIfzScYEwa+M1AxDDKZQqCtslD5IBBSJm2FgszJFL3DLW60Gcv5NS X-Gm-Message-State: AOJu0YxM/cyzqfKgRJ26JHZu+KZ6X2KKsCjtxPWujzOiyjSSVotulzp4 isOfRqSVOqdKQhPMABuhFUGRg7uGPxoafm4HVyAq57exCT3ocIlRQD20qROMnfpDCCcneezteh4 PizT/auIfBsuERBDhsyCXKam8Aszyf2TW X-Google-Smtp-Source: AGHT+IGji/Z26xmcHkogAm1ph3V9tH1xVRRQ4vhiw7Ca6Bt3O5MaNV6QuT7XVhbCJCQIekjB7oeT9Zkt9rMM X-Received: by 2002:a2e:86c8:0:b0:2eb:dabb:f2b2 with SMTP id 38308e7fff4ca-2ee8eda88famr29149391fa.30.1720191184198; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 5b1f17b1804b1-4264a22720dsm1381455e9.27.2024.07.05.07.53.03; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id D748660440; Fri, 5 Jul 2024 16:53:03 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sPkJ5-007Cqm-IL; Fri, 05 Jul 2024 16:53:03 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel , stable@vger.kernel.org Subject: [PATCH net v2 3/4] ipv6: take care of scope when choosing the src addr Date: Fri, 5 Jul 2024 16:52:14 +0200 Message-ID: <20240705145302.1717632-4-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> References: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside. CC: stable@vger.kernel.org Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern --- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5c424a0e7232..4f2c5cc31015 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, master, &dst, scores, hiscore_idx); - if (scores[hiscore_idx].ifa) + if (scores[hiscore_idx].ifa && + scores[hiscore_idx].scopedist >= 0) goto out; } From patchwork Fri Jul 5 14:52:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 13725223 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lf1-f98.google.com (mail-lf1-f98.google.com [209.85.167.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5754316B386 for ; Fri, 5 Jul 2024 14:53:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.98 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191188; cv=none; b=Ma3FsbpBYDx1cTm3y6taLWf2ntXgXMlQLH4xgifxcqETLSYI93JAYmHXPlVjKImCwfzRAqDHOGIsB7TewaYwo4yI/P8ac7BxHgKLliHXfezwIUoRiC/WI7bvVDay3JIUEOUUocpZrTd9eJJ6cHzRkxeCVAxYk3t/58t2Xc/djF8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720191188; c=relaxed/simple; bh=uwqjNUwUGD8gteHdinLEg/tWmncxkHI4qSyhvQZI4Hs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Z7JcrP8yHySe92o6qCPhU0IxnOPLZt071nYjU7Nb13s7NubwzDbHTUpstosGH6kwUg8EOzZDWFsFX7gQcep366GF6KKAvAXazFDm4gt775WGMRqCPnqYbL4dx3Xvi/Zvat8KaFZHgb2gL3rrdiX4ANME9k95IifbcqIhHvlkv/Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com; spf=pass smtp.mailfrom=6wind.com; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b=Gj6qX3if; arc=none smtp.client-ip=209.85.167.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=6wind.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=6wind.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=6wind.com header.i=@6wind.com header.b="Gj6qX3if" Received: by mail-lf1-f98.google.com with SMTP id 2adb3069b0e04-52ea7bdde68so662826e87.0 for ; Fri, 05 Jul 2024 07:53:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1720191184; x=1720795984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Sh/xrVxdryJoBZutF3XDro6l1fJuyxirwlBpLQ1IEHM=; b=Gj6qX3ifai+/fCDtKC5JaVcdmhlH4Gd5nUCQtwzULzTxQZ3Z3RNmEqd9Dl/xtjnodG YRxpb8zIUV5+Jokfio2g3LRMucgGCRkrk+oc52Ec6Pu99jX37EPSYe1rJTpraf/Cn9Zm hRezbQvBJsvYK/sP2LH3yNOjkKItoAwqCrlXk1AMYK/8/GJK5cYb1uFnKTod1VX3M40k xOEzcL4HfgKi8H9OffrwaO+5xATgdeztbSxNWUBo+tbdIAsy8janW881u2JntoqLAv90 9uoaXN68rQzeAUMTRWSCIILKz7h7c5LuoU+P5IhONfJoyF5j0Y+tme6Ql0G77/TzUaTp tjTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720191184; x=1720795984; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Sh/xrVxdryJoBZutF3XDro6l1fJuyxirwlBpLQ1IEHM=; b=GtV64whRRDo5kwKJ1Jm4gJomy1RhkNQC/+GdCt2dyPXOVWxuQ6mM2W2w4din6SfFZI LPl6WigGIFIAAlGQlBWpvJ2Tcvo4sPXEwZGLDpk3HMlSoibr4KaZdqWg8bTudfwoBEqH KK01tKBp2Zx9JU6LrRaPg3XBTzRnjNHHsx/dKzLRqfluK0f49bZUjRuMY+xKRMog8VI6 SPMa4qmYOExnl1TmIuG3wCRdCWljGmVfkkB1YiWI6ZLZjixlKrl1vZLKpXGdXjRpQQO0 wpgs2Q7Ygw7v/CaiNIKri4GfIwsLAklNMOU4h2KDPPyuwunmNUM6cF5aj8e8o0sYaabB Im6w== X-Forwarded-Encrypted: i=1; AJvYcCVAy2yDlCKMQfH/UguQXUK/xrrsQHXfV2ijovtR2gQiqJgdNIsxhh4cOnPtBdLOhPD82Hym936xmqMLufgtnP6vc3fE9Jbw X-Gm-Message-State: AOJu0Ywk/rs5UvXQax1O3bWrJNeu4ELAfe/i0gR16Xe/NLzK0cHEmRYK 8w/F23Idutv5saD2l/5nl8PP0/D1O3fI8y3xWEXF3rVQX48CpBVBib74J8dDmv38dFjhHzToD43 VE/cpn+IjDg6z4poK72np1Vx1G5wdttSs X-Google-Smtp-Source: AGHT+IFn92F+bdZ8VjiVzlanUSEzraIlCgnASI61XLBCGqvvZNuZYBqQduVmmNu8xNmEySqWEs+UlUQG0fWc X-Received: by 2002:a2e:9689:0:b0:2ee:44f7:cc74 with SMTP id 38308e7fff4ca-2ee8ed66d3cmr33435161fa.6.1720191184492; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id 38308e7fff4ca-2ee5160e2c4sm2963631fa.21.2024.07.05.07.53.04; Fri, 05 Jul 2024 07:53:04 -0700 (PDT) X-Relaying-Domain: 6wind.com Received: from bretzel (bretzel.dev.6wind.com [10.17.1.57]) by smtpservice.6wind.com (Postfix) with ESMTPS id DB1B26047E; Fri, 5 Jul 2024 16:53:03 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.94.2) (envelope-from ) id 1sPkJ5-007Cqp-Ip; Fri, 05 Jul 2024 16:53:03 +0200 From: Nicolas Dichtel To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: David Ahern , netdev@vger.kernel.org, Nicolas Dichtel Subject: [PATCH net v2 4/4] selftests: vrf_route_leaking: add local ping test Date: Fri, 5 Jul 2024 16:52:15 +0200 Message-ID: <20240705145302.1717632-5-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.43.1 In-Reply-To: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> References: <20240705145302.1717632-1-nicolas.dichtel@6wind.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The goal is to check that the source address selected by the kernel is routable when a leaking route is used. The symmetric topology is enough for this test. Signed-off-by: Nicolas Dichtel --- .../selftests/net/vrf_route_leaking.sh | 30 +++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/vrf_route_leaking.sh b/tools/testing/selftests/net/vrf_route_leaking.sh index 2da32f4c479b..1fd8ceb0711c 100755 --- a/tools/testing/selftests/net/vrf_route_leaking.sh +++ b/tools/testing/selftests/net/vrf_route_leaking.sh @@ -533,6 +533,30 @@ ipv6_ping_frag_asym() ipv6_ping_frag asym } +ipv4_ping_local() +{ + log_section "IPv4 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity || return + + run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP} + log_test $? 0 "VRF ICMP local IPv4" +} + +ipv6_ping_local() +{ + log_section "IPv6 (sym route): VRF ICMP local error route lookup ping" + + setup_sym + + check_connectivity6 || return + + run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6} + log_test $? 0 "VRF ICMP local IPv6" +} + ################################################################################ # usage @@ -555,8 +579,8 @@ EOF # Some systems don't have a ping6 binary anymore command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping) -TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym" -TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym" +TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_ping_ttl_asym ipv4_traceroute_asym" +TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_ping_ttl_asym ipv6_traceroute_asym" ret=0 nsuccess=0 @@ -594,12 +618,14 @@ do ipv4_traceroute|traceroute) ipv4_traceroute;;& ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;& ipv4_ping_frag|ping) ipv4_ping_frag;;& + ipv4_ping_local|ping) ipv4_ping_local;;& ipv6_ping_ttl|ping) ipv6_ping_ttl;;& ipv6_ping_ttl_asym|ping) ipv6_ping_ttl_asym;;& ipv6_traceroute|traceroute) ipv6_traceroute;;& ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;& ipv6_ping_frag|ping) ipv6_ping_frag;;& + ipv6_ping_local|ping) ipv6_ping_local;;& # setup namespaces and config, but do not run any tests setup_sym|setup) setup_sym; exit 0;;