BPF List
 help / color / mirror / Atom feed
From: Matthieu Baerts <matttbe@kernel.org>
To: "Íñigo Huguet" <ihuguet@riseup.net>,
	"David Ahern" <dsahern@kernel.org>,
	"Andrew Lunn" <andrew+netdev@lunn.ch>,
	"David S. Miller" <davem@davemloft.net>,
	"Eric Dumazet" <edumazet@google.com>,
	"Jakub Kicinski" <kuba@kernel.org>,
	"Paolo Abeni" <pabeni@redhat.com>,
	"Neal Cardwell" <ncardwell@google.com>,
	"Ido Schimmel" <idosch@nvidia.com>,
	"Pablo Neira Ayuso" <pablo@netfilter.org>,
	"Florian Westphal" <fw@strlen.de>,
	"Willem de Bruijn" <willemdebruijn.kernel@gmail.com>
Cc: Simon Horman <horms@kernel.org>,
	Kuniyuki Iwashima <kuniyu@google.com>, Phil Sutter <phil@nwl.cc>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Fernando Fernandez Mancera <fmancera@suse.de>,
	Alexei Starovoitov <ast@kernel.org>,
	Junseo Lim <zirajs7@gmail.com>, Leon Hwang <leon.hwang@linux.dev>,
	Xuanqiang Luo <luoxuanqiang@kylinos.cn>,
	Willem de Bruijn <willemb@google.com>,
	Kees Cook <kees@kernel.org>, Qi Tang <tpluszz77@gmail.com>,
	Jeff Layton <jlayton@kernel.org>, Joe Damato <joe@dama.to>,
	Breno Leitao <leitao@debian.org>,
	Li RongQing <lirongqing@baidu.com>,
	"open list:VRF" <netdev@vger.kernel.org>,
	open list <linux-kernel@vger.kernel.org>,
	"open list:NETFILTER" <netfilter-devel@vger.kernel.org>,
	"open list:NETFILTER" <coreteam@netfilter.org>,
	"open list:BPF [MISC] :Keyword:(?:b|_)bpf(?:b|_)"
	<bpf@vger.kernel.org>
Subject: Re: [PATCH net] net/ipv6: don't route packets with unknown source address
Date: Tue, 1 Sep 2026 19:32:34 +0200	[thread overview]
Message-ID: <3d8ef804-efc1-46c7-bbb4-f1a6c26fed8b@kernel.org> (raw)
In-Reply-To: <20260901115021.50057-1-ihuguet@riseup.net>

Hi Íñigo,

On 01/09/2026 13:50, Íñigo Huguet wrote:
> Don't allow routing packets with a source address that is not configured
> in the host. Allow it only in certain cases like when using a
> transparent socket, by setting the ANYSRC flag in flowi_flags.
> 
> Until now, it was possible to send such a packet if a route can be found
> in the routing table for it. For example:
> 1. Configure an address 1:2::3:4/64 and a static route 1:2::/64
> 2. Establish a TCP connection to 1:2::3:4
> 3. Remove the address from the interface, but keep the route.
> 4. Packets are still sent out by the TCP connection because of
>    the static route. No incoming packets are accepted, though.
> 
> This patch prevents the outgoing packets to be sent in normal
> circumnstances.
> 
> This aligns the behaviour with the IPv4 stack. To determine the places
> where the ANYSRC needs to be set, I set the flag in the same places as
> the IPv4 stack does.
> 
> Apart from consolidating the behaviour of both stacks, there is a more
> important reason why this is needed. RFC 4862 states that "an invalid
> address MUST NOT be used as the source address of outbound packets".
> Therefore, sending packets with a source address considered "invalid",
> like an expired address, is disallowed.

Thank you for looking at this, but I think your patch is causing
multiple KASAN warnings, e.g.

https://netdev-ctrl.bots.linux.dev/logs/vmksft/net-extra-dbg/results/804584/24-connect-deny-ipv6/stderr

And a few more, see:

https://netdev.bots.linux.dev/branch_deltas/net-next-2026-09-01--15-01.html

Cheers,
Matt
-- 
pw-bot: cr


  reply	other threads:[~2026-09-01 17:32 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-01 11:50 [PATCH net] net/ipv6: don't route packets with unknown source address Íñigo Huguet
2026-09-01 17:32 ` Matthieu Baerts [this message]
2026-09-02 10:08   ` Íñigo Huguet
2026-09-02  6:43 ` [syzbot ci] " syzbot ci
2026-09-02 11:51 ` [PATCH net] " sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3d8ef804-efc1-46c7-bbb4-f1a6c26fed8b@kernel.org \
    --to=matttbe@kernel.org \
    --cc=andrew+netdev@lunn.ch \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=dsahern@kernel.org \
    --cc=edumazet@google.com \
    --cc=fmancera@suse.de \
    --cc=fw@strlen.de \
    --cc=horms@kernel.org \
    --cc=idosch@nvidia.com \
    --cc=ihuguet@riseup.net \
    --cc=jlayton@kernel.org \
    --cc=joe@dama.to \
    --cc=kees@kernel.org \
    --cc=kuba@kernel.org \
    --cc=kuniyu@google.com \
    --cc=leitao@debian.org \
    --cc=leon.hwang@linux.dev \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lirongqing@baidu.com \
    --cc=luoxuanqiang@kylinos.cn \
    --cc=ncardwell@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pablo@netfilter.org \
    --cc=phil@nwl.cc \
    --cc=tpluszz77@gmail.com \
    --cc=willemb@google.com \
    --cc=willemdebruijn.kernel@gmail.com \
    --cc=zirajs7@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox