[PATCH net v2 0/4] vrf: fix source address selection with route leak

[PATCH net v2 0/4] vrf: fix source address selection with route leak

[Nicolas Dichtel]

For patch 1 and 2, I didn't find the exact commit that introduced this bug, but
I suspect it has been here since the first version. I arbitrarily choose one.

v1 -> v2:
 patch 2: Fix 'same_vrf' calculation
 patch 4: remove test about the topology type (only symmetric topology is
          supported now).

 include/net/ip6_route.h                          | 19 +++++++++------
 net/ipv4/fib_semantics.c                         | 11 +++++++--
 net/ipv6/addrconf.c                              |  3 ++-
 net/ipv6/ip6_output.c                            |  1 +
 net/ipv6/route.c                                 |  2 +-
 tools/testing/selftests/net/vrf_route_leaking.sh | 30 ++++++++++++++++++++++--
 6 files changed, 53 insertions(+), 13 deletions(-)

Comments are welcome.

Regards,
Nicolas

[PATCH net v2 1/4] ipv4: fix source address selection with route leak

[Nicolas Dichtel]

By default, an address assigned to the output interface is selected when
the source address is not specified. This is problematic when a route,
configured in a vrf, uses an interface from another vrf (aka route leak).
The original vrf does not own the selected source address.

Let's add a check against the output interface and call the appropriate
function to select the source address.

CC: stable@vger.kernel.org
Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
 net/ipv4/fib_semantics.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index f669da98d11d..459082f4936d 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -2270,6 +2270,13 @@ void fib_select_path(struct net *net, struct fib_result *res,
 		fib_select_default(fl4, res);
 
 check_saddr:
-	if (!fl4->saddr)
-		fl4->saddr = fib_result_prefsrc(net, res);
+	if (!fl4->saddr) {
+		struct net_device *l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);
+
+		if (!l3mdev ||
+		    l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev)
+			fl4->saddr = fib_result_prefsrc(net, res);
+		else
+			fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK);
+	}
 }
-- 
2.43.1

[PATCH net v2 2/4] ipv6: fix source address selection with route leak

[Nicolas Dichtel]

By default, an address assigned to the output interface is selected when
the source address is not specified. This is problematic when a route,
configured in a vrf, uses an interface from another vrf (aka route leak).
The original vrf does not own the selected source address.

Let's add a check against the output interface and call the appropriate
function to select the source address.

CC: stable@vger.kernel.org
Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
 include/net/ip6_route.h | 19 ++++++++++++-------
 net/ipv6/ip6_output.c   |  1 +
 net/ipv6/route.c        |  2 +-
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index a18ed24fed94..a7c27f0c6bce 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -127,18 +127,23 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
 
 static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
 				      const struct in6_addr *daddr,
-				      unsigned int prefs,
+				      unsigned int prefs, int l3mdev_index,
 				      struct in6_addr *saddr)
 {
+	struct net_device *l3mdev;
+	struct net_device *dev;
+	bool same_vrf;
 	int err = 0;
 
-	if (f6i && f6i->fib6_prefsrc.plen) {
+	rcu_read_lock();
+	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
+	dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
+	same_vrf = l3mdev == NULL || l3mdev_master_dev_rcu(dev) == l3mdev;
+	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
 		*saddr = f6i->fib6_prefsrc.addr;
-	} else {
-		struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
-
-		err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
-	}
+	else
+		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
+	rcu_read_unlock();
 
 	return err;
 }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 27d8725445e3..784424ac4147 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
 		from = rt ? rcu_dereference(rt->from) : NULL;
 		err = ip6_route_get_saddr(net, from, &fl6->daddr,
 					  sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
+					  fl6->flowi6_l3mdev,
 					  &fl6->saddr);
 		rcu_read_unlock();
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8d72ca0b086d..c9a9506b714d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 				goto nla_put_failure;
 	} else if (dest) {
 		struct in6_addr saddr_buf;
-		if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 &&
+		if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&
 		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
 			goto nla_put_failure;
 	}
-- 
2.43.1

[PATCH net v2 3/4] ipv6: take care of scope when choosing the src addr

[Nicolas Dichtel]

When the source address is selected, the scope must be checked. For
example, if a loopback address is assigned to the vrf device, it must not
be chosen for packets sent outside.

CC: stable@vger.kernel.org
Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
 net/ipv6/addrconf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5c424a0e7232..4f2c5cc31015 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
 							    master, &dst,
 							    scores, hiscore_idx);
 
-			if (scores[hiscore_idx].ifa)
+			if (scores[hiscore_idx].ifa &&
+			    scores[hiscore_idx].scopedist >= 0)
 				goto out;
 		}
 
-- 
2.43.1

[PATCH net v2 4/4] selftests: vrf_route_leaking: add local ping test

[Nicolas Dichtel]

The goal is to check that the source address selected by the kernel is
routable when a leaking route is used.
The symmetric topology is enough for this test.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
 .../selftests/net/vrf_route_leaking.sh        | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/vrf_route_leaking.sh b/tools/testing/selftests/net/vrf_route_leaking.sh
index 2da32f4c479b..1fd8ceb0711c 100755
--- a/tools/testing/selftests/net/vrf_route_leaking.sh
+++ b/tools/testing/selftests/net/vrf_route_leaking.sh
@@ -533,6 +533,30 @@ ipv6_ping_frag_asym()
 	ipv6_ping_frag asym
 }
 
+ipv4_ping_local()
+{
+	log_section "IPv4 (sym route): VRF ICMP local error route lookup ping"
+
+	setup_sym
+
+	check_connectivity || return
+
+	run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP}
+	log_test $? 0 "VRF ICMP local IPv4"
+}
+
+ipv6_ping_local()
+{
+	log_section "IPv6 (sym route): VRF ICMP local error route lookup ping"
+
+	setup_sym
+
+	check_connectivity6 || return
+
+	run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6}
+	log_test $? 0 "VRF ICMP local IPv6"
+}
+
 ################################################################################
 # usage
 
@@ -555,8 +579,8 @@ EOF
 # Some systems don't have a ping6 binary anymore
 command -v ping6 > /dev/null 2>&1 && ping6=$(command -v ping6) || ping6=$(command -v ping)
 
-TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_ttl_asym ipv4_traceroute_asym"
-TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_ttl_asym ipv6_traceroute_asym"
+TESTS_IPV4="ipv4_ping_ttl ipv4_traceroute ipv4_ping_frag ipv4_ping_local ipv4_ping_ttl_asym ipv4_traceroute_asym"
+TESTS_IPV6="ipv6_ping_ttl ipv6_traceroute ipv6_ping_local ipv6_ping_ttl_asym ipv6_traceroute_asym"
 
 ret=0
 nsuccess=0
@@ -594,12 +618,14 @@ do
 	ipv4_traceroute|traceroute)      ipv4_traceroute;;&
 	ipv4_traceroute_asym|traceroute) ipv4_traceroute_asym;;&
 	ipv4_ping_frag|ping)             ipv4_ping_frag;;&
+	ipv4_ping_local|ping)            ipv4_ping_local;;&
 
 	ipv6_ping_ttl|ping)              ipv6_ping_ttl;;&
 	ipv6_ping_ttl_asym|ping)         ipv6_ping_ttl_asym;;&
 	ipv6_traceroute|traceroute)      ipv6_traceroute;;&
 	ipv6_traceroute_asym|traceroute) ipv6_traceroute_asym;;&
 	ipv6_ping_frag|ping)             ipv6_ping_frag;;&
+	ipv6_ping_local|ping)            ipv6_ping_local;;&
 
 	# setup namespaces and config, but do not run any tests
 	setup_sym|setup)                 setup_sym; exit 0;;
-- 
2.43.1

Re: [PATCH net v2 1/4] ipv4: fix source address selection with route leak

[David Ahern]

On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
> By default, an address assigned to the output interface is selected when
> the source address is not specified. This is problematic when a route,
> configured in a vrf, uses an interface from another vrf (aka route leak).
> The original vrf does not own the selected source address.
> 
> Let's add a check against the output interface and call the appropriate
> function to select the source address.
> 
> CC: stable@vger.kernel.org
> Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> ---
>  net/ipv4/fib_semantics.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> index f669da98d11d..459082f4936d 100644
> --- a/net/ipv4/fib_semantics.c
> +++ b/net/ipv4/fib_semantics.c
> @@ -2270,6 +2270,13 @@ void fib_select_path(struct net *net, struct fib_result *res,
>  		fib_select_default(fl4, res);
>  
>  check_saddr:
> -	if (!fl4->saddr)
> -		fl4->saddr = fib_result_prefsrc(net, res);
> +	if (!fl4->saddr) {
> +		struct net_device *l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);

long line length. separate setting the value:

		struct net_device *l3mdev;

		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);

> +
> +		if (!l3mdev ||
> +		    l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev)
> +			fl4->saddr = fib_result_prefsrc(net, res);
> +		else
> +			fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK);
> +	}
>  }

Re: [PATCH net v2 2/4] ipv6: fix source address selection with route leak

[David Ahern]

On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
> index a18ed24fed94..a7c27f0c6bce 100644
> --- a/include/net/ip6_route.h
> +++ b/include/net/ip6_route.h
> @@ -127,18 +127,23 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
>  
>  static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
>  				      const struct in6_addr *daddr,
> -				      unsigned int prefs,
> +				      unsigned int prefs, int l3mdev_index,
>  				      struct in6_addr *saddr)
>  {
> +	struct net_device *l3mdev;
> +	struct net_device *dev;
> +	bool same_vrf;
>  	int err = 0;
>  
> -	if (f6i && f6i->fib6_prefsrc.plen) {
> +	rcu_read_lock();
> +	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
> +	dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
> +	same_vrf = l3mdev == NULL || l3mdev_master_dev_rcu(dev) == l3mdev;

!l3mdev; checkpatch should complain

> +	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
>  		*saddr = f6i->fib6_prefsrc.addr;
> -	} else {
> -		struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
> -
> -		err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
> -	}
> +	else
> +		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
> +	rcu_read_unlock();
>  
>  	return err;
>  }

lot of logic lines jammed together. put a new line after the read_lock()
and before the unlock().

Re: [PATCH net v2 3/4] ipv6: take care of scope when choosing the src addr

[David Ahern]

On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
> When the source address is selected, the scope must be checked. For
> example, if a loopback address is assigned to the vrf device, it must not
> be chosen for packets sent outside.
> 
> CC: stable@vger.kernel.org
> Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> ---
>  net/ipv6/addrconf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 


Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net v2 4/4] selftests: vrf_route_leaking: add local ping test

[David Ahern]

On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
> diff --git a/tools/testing/selftests/net/vrf_route_leaking.sh b/tools/testing/selftests/net/vrf_route_leaking.sh
> index 2da32f4c479b..1fd8ceb0711c 100755
> --- a/tools/testing/selftests/net/vrf_route_leaking.sh
> +++ b/tools/testing/selftests/net/vrf_route_leaking.sh
> @@ -533,6 +533,30 @@ ipv6_ping_frag_asym()
>  	ipv6_ping_frag asym
>  }
>  
> +ipv4_ping_local()
> +{
> +	log_section "IPv4 (sym route): VRF ICMP local error route lookup ping"
> +
> +	setup_sym
> +
> +	check_connectivity || return
> +
> +	run_cmd ip netns exec $r1 ip vrf exec blue ping -c1 -w1 ${H2_N2_IP}
> +	log_test $? 0 "VRF ICMP local IPv4"
> +}
> +
> +ipv6_ping_local()
> +{
> +	log_section "IPv6 (sym route): VRF ICMP local error route lookup ping"
> +
> +	setup_sym
> +
> +	check_connectivity6 || return
> +
> +	run_cmd ip netns exec $r1 ip vrf exec blue ${ping6} -c1 -w1 ${H2_N2_IP6}
> +	log_test $? 0 "VRF ICMP local IPv6"
> +}

please add tcp and udp tests as well.

Re: [PATCH net v2 1/4] ipv4: fix source address selection with route leak

[Nicolas Dichtel]

Le 07/07/2024 à 18:58, David Ahern a écrit :
> On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
>> By default, an address assigned to the output interface is selected when
>> the source address is not specified. This is problematic when a route,
>> configured in a vrf, uses an interface from another vrf (aka route leak).
>> The original vrf does not own the selected source address.
>>
>> Let's add a check against the output interface and call the appropriate
>> function to select the source address.
>>
>> CC: stable@vger.kernel.org
>> Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF")
>> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>> ---
>>  net/ipv4/fib_semantics.c | 11 +++++++++--
>>  1 file changed, 9 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
>> index f669da98d11d..459082f4936d 100644
>> --- a/net/ipv4/fib_semantics.c
>> +++ b/net/ipv4/fib_semantics.c
>> @@ -2270,6 +2270,13 @@ void fib_select_path(struct net *net, struct fib_result *res,
>>  		fib_select_default(fl4, res);
>>  
>>  check_saddr:
>> -	if (!fl4->saddr)
>> -		fl4->saddr = fib_result_prefsrc(net, res);
>> +	if (!fl4->saddr) {
>> +		struct net_device *l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);
> 
> long line length. separate setting the value:
> 
> 		struct net_device *l3mdev;
> 
> 		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);
The checkpatch limit is 100-column.
If the 80-column limit needs to be enforced in net/, maybe a special case should
be added in checkpatch.


Regards,
Nicolas

Re: [PATCH net v2 2/4] ipv6: fix source address selection with route leak

[Nicolas Dichtel]

Le 07/07/2024 à 18:58, David Ahern a écrit :
> On 7/5/24 8:52 AM, Nicolas Dichtel wrote:
>> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
>> index a18ed24fed94..a7c27f0c6bce 100644
>> --- a/include/net/ip6_route.h
>> +++ b/include/net/ip6_route.h
>> @@ -127,18 +127,23 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
>>  
>>  static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
>>  				      const struct in6_addr *daddr,
>> -				      unsigned int prefs,
>> +				      unsigned int prefs, int l3mdev_index,
>>  				      struct in6_addr *saddr)
>>  {
>> +	struct net_device *l3mdev;
>> +	struct net_device *dev;
>> +	bool same_vrf;
>>  	int err = 0;
>>  
>> -	if (f6i && f6i->fib6_prefsrc.plen) {
>> +	rcu_read_lock();
>> +	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
>> +	dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
>> +	same_vrf = l3mdev == NULL || l3mdev_master_dev_rcu(dev) == l3mdev;
> 
> !l3mdev; checkpatch should complain
No. I was unaware of this preference, is there a rule written somewhere about this?

$ git grep '(![a-zA-Z])' net/ipv6/ | wc -l
43
$ git grep '== NULL' net/ipv6/ | wc -l
44

It seems both are used.


Regards,
Nicolas

Re: [PATCH net v2 2/4] ipv6: fix source address selection with route leak

[David Ahern]

On 7/8/24 12:15 PM, Nicolas Dichtel wrote:
>> !l3mdev; checkpatch should complain
> No. I was unaware of this preference, is there a rule written somewhere about this?

checkpatch

Re: [PATCH net v2 1/4] ipv4: fix source address selection with route leak

[Jakub Kicinski]

On Mon, 8 Jul 2024 20:13:56 +0200 Nicolas Dichtel wrote:
> > long line length. separate setting the value:
> > 
> > 		struct net_device *l3mdev;
> > 
> > 		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);  
> The checkpatch limit is 100-column.
> If the 80-column limit needs to be enforced in net/, maybe a special case should
> be added in checkpatch.

That'd be great. I'm pretty unsuccessful to at getting my patches
accepted to checkpatch and get_maintainers so I gave up.
But I never tried with the line length limit.

Re: [PATCH net v2 2/4] ipv6: fix source address selection with route leak

[Nicolas Dichtel]

Le 08/07/2024 à 20:44, David Ahern a écrit :
> On 7/8/24 12:15 PM, Nicolas Dichtel wrote:
>>> !l3mdev; checkpatch should complain
>> No. I was unaware of this preference, is there a rule written somewhere about this?
> 
> checkpatch
> 
After digging a bit more, I should run checkpatch with '--strict' to get it.

Thanks,
Nicolas

Re: [PATCH net v2 1/4] ipv4: fix source address selection with route leak

[Nicolas Dichtel]

Le 08/07/2024 à 22:32, Jakub Kicinski a écrit :
> On Mon, 8 Jul 2024 20:13:56 +0200 Nicolas Dichtel wrote:
>>> long line length. separate setting the value:
>>>
>>> 		struct net_device *l3mdev;
>>>
>>> 		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);  
>> The checkpatch limit is 100-column.
>> If the 80-column limit needs to be enforced in net/, maybe a special case should
>> be added in checkpatch.
> 
> That'd be great. I'm pretty unsuccessful to at getting my patches
> accepted to checkpatch and get_maintainers so I gave up.
Oh, ok :/

> But I never tried with the line length limit.
Why not (: