Commit d657f5c7 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'vrf-fix-source-address-selection-with-route-leak' 

Nicolas Dichtel says:

====================
vrf: fix source address selection with route leak

For patch 1 and 2, I didn't find the exact commit that introduced this bug, but
I suspect it has been here since the first version. I arbitrarily choose one.
====================

Link: https://patch.msgid.link/20240710081521.3809742-1-nicolas.dichtel@6wind.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents f67a90a0 39367183

include/net/ip6_route.h

+14 −6
Original line number Diff line number Diff line
@@ -127,18 +127,26 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args, 


static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,

				      const struct in6_addr *daddr,

				      unsigned int prefs,

				      unsigned int prefs, int l3mdev_index,

				      struct in6_addr *saddr)

{

	struct net_device *l3mdev;

	struct net_device *dev;

	bool same_vrf;

	int err = 0;



	if (f6i && f6i->fib6_prefsrc.plen) {

	rcu_read_lock();



	l3mdev = dev_get_by_index_rcu(net, l3mdev_index);

	if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev)

		dev = f6i ? fib6_info_nh_dev(f6i) : NULL;

	same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;

	if (f6i && f6i->fib6_prefsrc.plen && same_vrf)

		*saddr = f6i->fib6_prefsrc.addr;

	} else {

		struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;

	else

		err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);



		err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);

	}

	rcu_read_unlock();



	return err;

}

net/ipv4/fib_semantics.c

+11 −2
Original line number Diff line number Diff line
@@ -2270,6 +2270,15 @@ void fib_select_path(struct net *net, struct fib_result *res, 
		fib_select_default(fl4, res);



check_saddr:

	if (!fl4->saddr)

	if (!fl4->saddr) {

		struct net_device *l3mdev;



		l3mdev = dev_get_by_index_rcu(net, fl4->flowi4_l3mdev);



		if (!l3mdev ||

		    l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) == l3mdev)

			fl4->saddr = fib_result_prefsrc(net, res);

		else

			fl4->saddr = inet_select_addr(l3mdev, 0, RT_SCOPE_LINK);

	}

}

net/ipv6/addrconf.c

+2 −1
Original line number Diff line number Diff line
@@ -1873,7 +1873,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, 
							    master, &dst,

							    scores, hiscore_idx);



			if (scores[hiscore_idx].ifa)

			if (scores[hiscore_idx].ifa &&

			    scores[hiscore_idx].scopedist >= 0)

				goto out;

		}

net/ipv6/ip6_output.c

+1 −0
Original line number Diff line number Diff line
@@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, 
		from = rt ? rcu_dereference(rt->from) : NULL;

		err = ip6_route_get_saddr(net, from, &fl6->daddr,

					  sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,

					  fl6->flowi6_l3mdev,

					  &fl6->saddr);

		rcu_read_unlock();

net/ipv6/route.c

+1 −1
Original line number Diff line number Diff line
@@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, 
				goto nla_put_failure;

	} else if (dest) {

		struct in6_addr saddr_buf;

		if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 &&

		if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&

		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))

			goto nla_put_failure;

	}