[PATCH net 3/4] ipv6: udp: Create exceptions when socket matching failed

[Ido Schimmel <idosch@nvidia.com>]

Currently, when ICMPv6 Packet Too Big and Redirect Message packets are
locally delivered and quote a UDP packet, an exception is created in the
IPv6 exception cache only if the kernel can match the UDP packet to an
existing socket.

This behavior allows off-path attackers to conduct a side-channel attack
on the exception cache in order to discover the ephemeral port used by a
connected UDP socket.

Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and
commit a00df2caffed ("ipv6: make exception cache less predictible") tried
to mitigate such attacks by making it harder for attackers to discover
hash collisions in the exception cache and by randomizing the number of
exceptions a hash bucket can hold, respectively. Unfortunately, both of
the mitigations can be bypassed.

Instead, mitigate such attacks by always creating an exception, even if
socket matching failed. Do that by calling ip6_update_pmtu() and
ip6_redirect(), the helpers used when the quoted packet did not
originate from a socket. The resulting exception is indistinguishable
from the one created when socket matching succeeded, both in terms of
cache occupancy and in terms of its contents.

Pass the ifindex of the ingress device and the default uid, in a similar
fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any
nexthop in ip6_redirect_nh_match() and no exception would be created in
response to a Redirect Message.

Note that this does not allow attackers to create exceptions that they
could not create before, as both helpers can already be reached with
little to no validation. For example, by sending an ICMPv6 error that
quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that
matches a wildcard socket.

Also create an exception when a socket does not wish to accept PMTU
updates (e.g., by setting 'IPV6_PMTUDISC_OMIT'). Otherwise, the fact
that an exception was not created can indicate to an off-path attacker
that a socket exists. Unlike IPv4, the check is performed in udpv6_err()
and not in ip6_sk_update_pmtu(), as its only other caller, rawv6_err(),
does not consult ip6_sk_accept_pmtu() and therefore already creates an
exception unconditionally.

Fixes: 2b760fcf5cfb ("ipv6: hook up exception table to store dst cache")
Cc: stable@vger.kernel.org
Reported-by: Amit Klein <aksecurity@gmail.com>
Reported-by: Noam Caspi <noam.caspi@mail.huji.ac.il>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv6/udp.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index fd875908ac0c..df14fc2afe8a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -690,6 +690,17 @@ static struct sock *__udp6_lib_err_encap(struct net *net,
 	return sk;
 }
 
+static void udpv6_err_no_sk(struct net *net, struct sk_buff *skb, u8 type,
+			    __be32 info)
+{
+	if (type == ICMPV6_PKT_TOOBIG)
+		ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0,
+				sock_net_uid(net, NULL));
+	else if (type == NDISC_REDIRECT)
+		ip6_redirect(skb, net, skb->dev->ifindex, 0,
+			     sock_net_uid(net, NULL));
+}
+
 static int udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		     u8 type, u8 code, int offset, __be32 info)
 {
@@ -719,6 +730,7 @@ static int udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 			sk = ERR_PTR(-ENOENT);
 
 		if (IS_ERR(sk)) {
+			udpv6_err_no_sk(net, skb, type, info);
 			__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 					  ICMP6_MIB_INERRORS);
 			return PTR_ERR(sk);
@@ -731,8 +743,11 @@ static int udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	np = inet6_sk(sk);
 
 	if (type == ICMPV6_PKT_TOOBIG) {
-		if (!ip6_sk_accept_pmtu(sk))
+		if (!ip6_sk_accept_pmtu(sk)) {
+			ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0,
+					sock_net_uid(net, NULL));
 			goto out;
+		}
 		ip6_sk_update_pmtu(skb, sk, info);
 		if (READ_ONCE(np->pmtudisc) != IPV6_PMTUDISC_DONT)
 			harderr = 1;
-- 
2.55.0