[PATCH v3 net-next] net/ipv6: Do not allow route add with a device that is down

[PATCH v3 net-next] net/ipv6: Do not allow route add with a device that is down

[David Ahern]

IPv6 allows routes to be installed when the device is not up (admin up).
Worse, it does not mark it as LINKDOWN. IPv4 does not allow it and really
there is no reason for IPv6 to allow it, so check the flags and deny if
device is admin down.

Signed-off-by: David Ahern <dsahern@gmail.com>
---
v3
- moved err=-ENETDOWN under the if check per Eric's request
- left the up check using dev->flags for consistency with IPv4
  and that it is used more often in ipv4 and ivp6 code than
  netif_running

v2
- missed setting err to -ENETDOWN (thanks for catching that Roopa)

 net/ipv6/route.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f85da2f1e729..aa4411c81e7e 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2734,6 +2734,12 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg,
 	if (!dev)
 		goto out;
 
+	if (!(dev->flags & IFF_UP)) {
+		NL_SET_ERR_MSG(extack, "Nexthop device is not up");
+		err = -ENETDOWN;
+		goto out;
+	}
+
 	if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
 		if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
 			NL_SET_ERR_MSG(extack, "Invalid source address");
-- 
2.11.0

Re: [PATCH v3 net-next] net/ipv6: Do not allow route add with a device that is down

[Ido Schimmel]

On Wed, Jan 24, 2018 at 07:45:29PM -0800, David Ahern wrote:
> IPv6 allows routes to be installed when the device is not up (admin up).
> Worse, it does not mark it as LINKDOWN. IPv4 does not allow it and really
> there is no reason for IPv6 to allow it, so check the flags and deny if
> device is admin down.
> 
> Signed-off-by: David Ahern <dsahern@gmail.com>

Reviewed-by: Ido Schimmel <idosch@mellanox.com>

Thanks!

Re: [PATCH v3 net-next] net/ipv6: Do not allow route add with a device that is down

[Roopa Prabhu]

On Wed, Jan 24, 2018 at 7:45 PM, David Ahern <dsahern@gmail.com> wrote:
> IPv6 allows routes to be installed when the device is not up (admin up).
> Worse, it does not mark it as LINKDOWN. IPv4 does not allow it and really
> there is no reason for IPv6 to allow it, so check the flags and deny if
> device is admin down.
>
> Signed-off-by: David Ahern <dsahern@gmail.com>

Reviewed-by: Roopa Prabhu <roopa@cumulusnetworks.com>

> ---
> v3
> - moved err=-ENETDOWN under the if check per Eric's request
> - left the up check using dev->flags for consistency with IPv4
>   and that it is used more often in ipv4 and ivp6 code than
>   netif_running
>
> v2
> - missed setting err to -ENETDOWN (thanks for catching that Roopa)
>
>  net/ipv6/route.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index f85da2f1e729..aa4411c81e7e 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -2734,6 +2734,12 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg,
>         if (!dev)
>                 goto out;
>
> +       if (!(dev->flags & IFF_UP)) {
> +               NL_SET_ERR_MSG(extack, "Nexthop device is not up");
> +               err = -ENETDOWN;
> +               goto out;
> +       }
> +
>         if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
>                 if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
>                         NL_SET_ERR_MSG(extack, "Invalid source address");
> --
> 2.11.0
>

Re: [PATCH v3 net-next] net/ipv6: Do not allow route add with a device that is down

[David Miller]

From: David Ahern <dsahern@gmail.com>
Date: Wed, 24 Jan 2018 19:45:29 -0800

> IPv6 allows routes to be installed when the device is not up (admin up).
> Worse, it does not mark it as LINKDOWN. IPv4 does not allow it and really
> there is no reason for IPv6 to allow it, so check the flags and deny if
> device is admin down.
> 
> Signed-off-by: David Ahern <dsahern@gmail.com>
> ---
> v3
> - moved err=-ENETDOWN under the if check per Eric's request
> - left the up check using dev->flags for consistency with IPv4
>   and that it is used more often in ipv4 and ivp6 code than
>   netif_running
> 
> v2
> - missed setting err to -ENETDOWN (thanks for catching that Roopa)

Applied, thanks David.