From: Matthieu Baerts <matttbe@kernel.org>
To: "Íñigo Huguet" <ihuguet@riseup.net>,
"David Ahern" <dsahern@kernel.org>,
"Andrew Lunn" <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Neal Cardwell" <ncardwell@google.com>,
"Ido Schimmel" <idosch@nvidia.com>,
"Pablo Neira Ayuso" <pablo@netfilter.org>,
"Florian Westphal" <fw@strlen.de>,
"Willem de Bruijn" <willemdebruijn.kernel@gmail.com>
Cc: Simon Horman <horms@kernel.org>,
Kuniyuki Iwashima <kuniyu@google.com>, Phil Sutter <phil@nwl.cc>,
Daniel Borkmann <daniel@iogearbox.net>,
Fernando Fernandez Mancera <fmancera@suse.de>,
Alexei Starovoitov <ast@kernel.org>,
Junseo Lim <zirajs7@gmail.com>, Leon Hwang <leon.hwang@linux.dev>,
Xuanqiang Luo <luoxuanqiang@kylinos.cn>,
Willem de Bruijn <willemb@google.com>,
Kees Cook <kees@kernel.org>, Qi Tang <tpluszz77@gmail.com>,
Jeff Layton <jlayton@kernel.org>, Joe Damato <joe@dama.to>,
Breno Leitao <leitao@debian.org>,
Li RongQing <lirongqing@baidu.com>,
"open list:VRF" <netdev@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>,
"open list:NETFILTER" <netfilter-devel@vger.kernel.org>,
"open list:NETFILTER" <coreteam@netfilter.org>,
"open list:BPF [MISC] :Keyword:(?:b|_)bpf(?:b|_)"
<bpf@vger.kernel.org>
Subject: Re: [PATCH net] net/ipv6: don't route packets with unknown source address
Date: Tue, 1 Sep 2026 19:32:34 +0200 [thread overview]
Message-ID: <3d8ef804-efc1-46c7-bbb4-f1a6c26fed8b@kernel.org> (raw)
In-Reply-To: <20260901115021.50057-1-ihuguet@riseup.net>
Hi Íñigo,
On 01/09/2026 13:50, Íñigo Huguet wrote:
> Don't allow routing packets with a source address that is not configured
> in the host. Allow it only in certain cases like when using a
> transparent socket, by setting the ANYSRC flag in flowi_flags.
>
> Until now, it was possible to send such a packet if a route can be found
> in the routing table for it. For example:
> 1. Configure an address 1:2::3:4/64 and a static route 1:2::/64
> 2. Establish a TCP connection to 1:2::3:4
> 3. Remove the address from the interface, but keep the route.
> 4. Packets are still sent out by the TCP connection because of
> the static route. No incoming packets are accepted, though.
>
> This patch prevents the outgoing packets to be sent in normal
> circumnstances.
>
> This aligns the behaviour with the IPv4 stack. To determine the places
> where the ANYSRC needs to be set, I set the flag in the same places as
> the IPv4 stack does.
>
> Apart from consolidating the behaviour of both stacks, there is a more
> important reason why this is needed. RFC 4862 states that "an invalid
> address MUST NOT be used as the source address of outbound packets".
> Therefore, sending packets with a source address considered "invalid",
> like an expired address, is disallowed.
Thank you for looking at this, but I think your patch is causing
multiple KASAN warnings, e.g.
https://netdev-ctrl.bots.linux.dev/logs/vmksft/net-extra-dbg/results/804584/24-connect-deny-ipv6/stderr
And a few more, see:
https://netdev.bots.linux.dev/branch_deltas/net-next-2026-09-01--15-01.html
Cheers,
Matt
--
pw-bot: cr
next prev parent reply other threads:[~2026-09-01 17:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 11:50 [PATCH net] net/ipv6: don't route packets with unknown source address Íñigo Huguet
2026-09-01 17:32 ` Matthieu Baerts [this message]
2026-09-02 10:08 ` Íñigo Huguet
2026-09-02 6:43 ` [syzbot ci] " syzbot ci
2026-09-02 11:51 ` [PATCH net] " sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3d8ef804-efc1-46c7-bbb4-f1a6c26fed8b@kernel.org \
--to=matttbe@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=coreteam@netfilter.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=fmancera@suse.de \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=ihuguet@riseup.net \
--cc=jlayton@kernel.org \
--cc=joe@dama.to \
--cc=kees@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=leitao@debian.org \
--cc=leon.hwang@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=lirongqing@baidu.com \
--cc=luoxuanqiang@kylinos.cn \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=tpluszz77@gmail.com \
--cc=willemb@google.com \
--cc=willemdebruijn.kernel@gmail.com \
--cc=zirajs7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.