[PATCH net 0/2] ipv6: drop encapsulated packets when no source address is available

[PATCH net 0/2] ipv6: drop encapsulated packets when no source address is available

[Justin Iurman]

Both ioam6 and seg6 (encap modes) lwtunnels select the source address of
the outer IPv6 header with ipv6_dev_get_saddr() when no tunnel source is
configured, but ignore its return value. When no usable address is
available (e.g. none configured yet in the L3 domain, or only tentative
ones), the outer source address is left untouched:
 - ioam6: it keeps the source address copied from the inner header,
   which may belong to another node for in-transit traffic;
 - seg6: the outer header has just been pushed, so it holds whatever
   stale bytes were in the skb headroom.

Both patches drop the packet in that case, like other encapsulation
failures.

Justin Iurman (2):
  ioam6: drop the packet if no outer source address is available
  seg6: drop the packet if no outer source address is available

 net/ipv6/ioam6_iptunnel.c | 11 +++++++----
 net/ipv6/seg6_iptunnel.c  | 26 ++++++++++++++++++--------
 2 files changed, 25 insertions(+), 12 deletions(-)

-- 
2.34.1

[PATCH net 1/2] ioam6: drop the packet if no outer source address is available

[Justin Iurman]

When no tunnel source is configured, ioam6_do_encap() ignores the
return value of ipv6_dev_get_saddr(). On failure, the outer header
keeps the source address copied from the inner header, so the packet
is sent with an address that may not belong to this node.

Drop the packet instead.

Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation")
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
---
 net/ipv6/ioam6_iptunnel.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index cfb2c41634a0..4990ae1ee78c 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -324,11 +324,14 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
 	hdr->payload_len = cpu_to_be16(skb->len - sizeof(*hdr));
 	hdr->daddr = *tundst;
 
-	if (has_tunsrc)
+	if (has_tunsrc) {
 		memcpy(&hdr->saddr, tunsrc, sizeof(*tunsrc));
-	else
-		ipv6_dev_get_saddr(net, dst_dev(dst), &hdr->daddr,
-				   IPV6_PREFER_SRC_PUBLIC, &hdr->saddr);
+	} else {
+		err = ipv6_dev_get_saddr(net, dst_dev(dst), &hdr->daddr,
+					 IPV6_PREFER_SRC_PUBLIC, &hdr->saddr);
+		if (unlikely(err))
+			return err;
+	}
 
 	skb_postpush_rcsum(skb, hdr, len);
 
-- 
2.34.1

[PATCH net 2/2] seg6: drop the packet if no outer source address is available

[Justin Iurman]

When no tunnel source is configured, set_tun_src() ignores the return
value of ipv6_dev_get_saddr(). On failure, the source address of the
freshly pushed outer header is never written, so the packet is sent
with whatever stale bytes were in the skb headroom.

Return the error from set_tun_src() and drop the packet; all callers
of the encap functions already handle their errors.

Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
---
 net/ipv6/seg6_iptunnel.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 3bc47c5614ff..395614fdb83f 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -107,12 +107,13 @@ static int nla_put_srh(struct sk_buff *skb, int attrtype,
 	return 0;
 }
 
-static void set_tun_src(struct net *net, struct net_device *dev,
-			struct in6_addr *daddr, struct in6_addr *saddr,
-			struct in6_addr *route_tunsrc)
+static int set_tun_src(struct net *net, struct net_device *dev,
+		       struct in6_addr *daddr, struct in6_addr *saddr,
+		       struct in6_addr *route_tunsrc)
 {
 	struct seg6_pernet_data *sdata = seg6_pernet(net);
 	struct in6_addr *tun_src;
+	int err = 0;
 
 	/* Priority order to select tunnel source address:
 	 *  1. per route source address (if configured)
@@ -128,12 +129,14 @@ static void set_tun_src(struct net *net, struct net_device *dev,
 		if (!ipv6_addr_any(tun_src)) {
 			memcpy(saddr, tun_src, sizeof(struct in6_addr));
 		} else {
-			ipv6_dev_get_saddr(net, dev, daddr,
-					   IPV6_PREFER_SRC_PUBLIC, saddr);
+			err = ipv6_dev_get_saddr(net, dev, daddr,
+						 IPV6_PREFER_SRC_PUBLIC, saddr);
 		}
 
 		rcu_read_unlock();
 	}
+
+	return err;
 }
 
 /* Compute flowlabel for outer IPv6 header */
@@ -213,7 +216,9 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
 	isrh->nexthdr = proto;
 
 	hdr->daddr = isrh->segments[isrh->first_segment];
-	set_tun_src(net, dev, &hdr->daddr, &hdr->saddr, route_tunsrc);
+	err = set_tun_src(net, dev, &hdr->daddr, &hdr->saddr, route_tunsrc);
+	if (unlikely(err))
+		return err;
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
 	if (sr_has_hmac(isrh)) {
@@ -304,7 +309,10 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb,
 	if (skip_srh) {
 		hdr->nexthdr = proto;
 
-		set_tun_src(net, dev, &hdr->daddr, &hdr->saddr, route_tunsrc);
+		err = set_tun_src(net, dev, &hdr->daddr, &hdr->saddr,
+				  route_tunsrc);
+		if (unlikely(err))
+			return err;
 		goto out;
 	}
 
@@ -340,7 +348,9 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb,
 
 srcaddr:
 	isrh->nexthdr = proto;
-	set_tun_src(net, dev, &hdr->daddr, &hdr->saddr, route_tunsrc);
+	err = set_tun_src(net, dev, &hdr->daddr, &hdr->saddr, route_tunsrc);
+	if (unlikely(err))
+		return err;
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
 	if (unlikely(!skip_srh && sr_has_hmac(isrh))) {
-- 
2.34.1

Re: [PATCH net 0/2] ipv6: drop encapsulated packets when no source address is available

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by LLM and not proven at runtime). If it was triggered
   please include the symptoms, like the stack trace or kernel messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account.

*IMPORTANT*: If you do repost (for other reasons) - please include
the relevant info in the cover letter or commit messages.
-- 
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.