(usagi-users 03778) [Patch][IPv6] Fix wrong routing mechanism for Link Local IPv6 packets

(usagi-users 03778) [Patch][IPv6] Fix wrong routing mechanism for Link Local IPv6 packets

[weidong]

Hi, all
	When I tested linux-2.6.19.2, and found maybe there're some packet
routing bugs in linux kernel. My test topology is shown as the
following:

         eth0: fe80::20c:29ff:fe24:fa0a
            |                     eth1: fe80::20c:29ff:fe24:fa14 
            |                      |
------------------------------------------------
            |                      |
            |                      |
            | LAN1                 |LAN2
            |                      |
          -----
            ^
            |  
     Send Echo Request(src addr = fe80::200:ff:fe00:100)

Now we send Echo Request to eth1(ipv6 src addr is fe80::200:ff:fe00:100,
ipv6 dst addr is fe80::20c:29ff:fe24:fa14) on LAN1. Linux will send
ICMPv6 Redirect Packet to us. And the TargetAddress =
fe80::20c:29ff:fe24:fa14, DestinationAddress = fe80::20c:29ff:fe24:fa14.
Obviously, Linux considers that fe80::200:ff:fe00:100 and
fe80::20c:29ff:fe24:fa14 is on the SAME link(LAN0). In fact, kernel
invoke function ip6_foward().

When Linux decides whether or not making use of a rt6_info entry, it
will match the rt->rt6i_idev and rt->rt6_dev. This is done in function
rt6_check_dev(). If nothing matched, rt6_check_dev() return 0. Then
function rt6_score_route() will check whether the matched ipv6 addr
(fe80::20c:29ff:fe24:fa14 in our example) is a link local ipv6 address.
If it is a link local address, and "rt->rt6i_idev" "rt->rt6_dev" match
failed -- rt6_check_dev() return 0. Function rt6_score_route() return -1
directly. I think here is a problem. 

When kernel match eth1 addr with rt6_info entries, it will lookup in
local_table first. In rt6_check_dev() matching "rt->rt6i_idev" "rt-
>rt6_dev" will fail. The reason is oif = 2 , rt->rt6i_idev->dev->ifindex
is 3 and rt->rt6i_dev->ifindex is 1. I think even this match failed,
rt6_score_route() should not return -1, but return 0. And I think check
for RT6_LOOKUP_F_IFACE flag isn't needed here. Checking for this flag is
only needed in route cache when matching dst addr.

Due to the reason mentioned above, all entries in local table matching
dst addr fe80::20c:29ff:fe24:fa14 are failed. And then kernel matches
main table. fe80::/64 entry in main table will match successfully. Later
ip6_rt_copy() will copy the function pointer rt->u.dst.input. Obviously
rt->u.dst.input in main table is ip6_forward().

The following is my patch.

signed-off-by: Wei Dong <weid@np.css.fujitsu.com>

diff -ruN old/net/ipv6/route.c new/net/ipv6/route.c
--- old/net/ipv6/route.c	2007-01-10 14:10:37.000000000 -0500
+++ new/net/ipv6/route.c	2007-01-17 18:24:51.336774016 -0500
@@ -343,7 +343,7 @@
 	int m, n;
 		
 	m = rt6_check_dev(rt, oif);
-	if (!m && (strict & RT6_LOOKUP_F_IFACE))
+	if (!m && (rt->rt6i_flags & RTF_CACHE) && (strict & RT6_LOOKUP_F_IFACE))
 		return -1;
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;

Re: [Patch][IPv6] Fix wrong routing mechanism for Link Local IPv6 packets

[YOSHIFUJI Hideaki / 吉藤英明]

Hello.

In article <1172042666.4512.8.camel@LINE> (at Wed, 21 Feb 2007 02:24:26 -0500), weidong <weid@np.css.fujitsu.com> says:

>          eth0: fe80::20c:29ff:fe24:fa0a
>             |                     eth1: fe80::20c:29ff:fe24:fa14 
>             |                      |
> ------------------------------------------------
>             |                      |
>             |                      |
>             | LAN1                 |LAN2
>             |                      |
>           -----
>             ^
>             |  
>      Send Echo Request(src addr = fe80::200:ff:fe00:100)

Sorry, I could not understand this figure....
Would you elaborate this?

--yoshfuji

Re: [Patch][IPv6] Fix wrong routing mechanism for Link Local IPv6 packets

[Wei Dong]

Hello, Mr yoshfuji
    Take ping6 for example. Asumming there is a router which has 2 NICs. 
eth0 on router has ipv6 addr fe80::20c:29ff:fe24:fa0a, eth1 on router has 
ipv6 addr fe80::20c:29ff:fe24:fa14. Also there is a host connected to 
router's eth0, and the host's ipv6 addr is fe80::200:ff:fe00:100. We ping6 
to router's eth1(ipv6 addr fe80::20c:29ff:fe24:fa14). But now Linux kernel 
deals with this kind of packet incorrectly. Router forward the Echo request 
to eth0. And send ICMP redirect packet to the host. In ICMP redirect packt 
TargetAddress =fe80::20c:29ff:fe24:fa14, DestinationAddress = 
fe80::20c:29ff:fe24:fa14. So I think Linux  kernel considers that 
fe80::200:ff:fe00:100 and fe80::20c:29ff:fe24:fa14 are neighbors.

I dived into the kernel, and found that maybe function rt6_score_route() has 
problems. In rt6_score_route(), if rt6_check_dev() return 0, and the dst 
ipv6 addr is link local addr, rt6_socre_route() return -1 directly. I think 
this is not correct, we should return -1 only if the entry is in the route 
cache, and the dst addr is link local addr. Only entries in cache will 
select wrong IPv6 Link Local NIC for a link local addr, because they are 
copied from static IPv6 fib tables.

----- Original Message ----- 
> Hello.
>
> In article <1172042666.4512.8.camel@LINE> (at Wed, 21 Feb 2007 
> 02:24:26 -0500), weidong <weid@np.css.fujitsu.com> says:
>
>>          eth0: fe80::20c:29ff:fe24:fa0a
>>             |                     eth1: fe80::20c:29ff:fe24:fa14
>>             |                      |
>> ------------------------------------------------
>>             |                      |
>>             |                      |
>>             | LAN1                 |LAN2
>>             |                      |
>>           -----
>>             ^
>>             |
>>      Send Echo Request(src addr = fe80::200:ff:fe00:100)
>
> Sorry, I could not understand this figure....
> Would you elaborate this?
>
> --yoshfuji 

Re: [Patch][IPv6] Fix wrong routing mechanism for Link Local IPv6 packets

[YOSHIFUJI Hideaki / 吉藤英明]

In article <024b01c74443$f882d590$ccb1220a@ZhaoleiSOTEC> (at Tue, 30 Jan 2007 16:55:12 +0900), "Wei Dong" <weid@np.css.fujitsu.com> says:

> Hello, Mr yoshfuji
>     Take ping6 for example. Asumming there is a router which has 2 NICs. 
> eth0 on router has ipv6 addr fe80::20c:29ff:fe24:fa0a, eth1 on router has 
> ipv6 addr fe80::20c:29ff:fe24:fa14. Also there is a host connected to 
> router's eth0, and the host's ipv6 addr is fe80::200:ff:fe00:100. We ping6 
:

I still need more precise figure.

Please draw complete box for the 2-3 boxes (pinger, router (and the
destination)), link(s) and interfaces.

+-------------+
|    Router   |
+---+-----+---+
eth0|     |eth1
    |     |
eth0|    
+---+-+
|Host1|
+-----+

Host1  eth0: fe80:....
Router eth0: fe80:....
Router eth1: fe80:...

Or, something like that....

I think you may use other tool such as tgif etc.

--yoshfuji