From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935350AbcKMX2h (ORCPT ); Sun, 13 Nov 2016 18:28:37 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:47032 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935184AbcKMX2f (ORCPT ); Sun, 13 Nov 2016 18:28:35 -0500 From: "Jason A. Donenfeld" To: David Ahern , Netdev , WireGuard mailing list , LKML , YOSHIFUJI Hideaki , Hannes Frederic Sowa Cc: "Jason A. Donenfeld" Subject: [PATCH v3] ip6_output: ensure flow saddr actually belongs to device Date: Mon, 14 Nov 2016 00:28:13 +0100 Message-Id: <20161113232813.28926-1-Jason@zx2c4.com> X-Mailer: git-send-email 2.10.2 In-Reply-To: <27cccef1-06d9-74b3-5b8a-912850119a76@cumulusnetworks.com> References: <27cccef1-06d9-74b3-5b8a-912850119a76@cumulusnetworks.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This puts the IPv6 routing functions in parity with the IPv4 routing functions. Namely, we now check in v6 that if a flowi6 requests an saddr, the returned dst actually corresponds to a net device that has that saddr. This mirrors the v4 logic with __ip_dev_find in __ip_route_output_key_hash. In the event that the returned dst is not for a dst with a dev that has the saddr, we return -EINVAL, just like v4; this makes it easy to use the same error handlers for both cases. Signed-off-by: Jason A. Donenfeld Cc: David Ahern --- Changes from v2: It turns out ipv6_chk_addr already has the device enumeration logic that we need by simply passing NULL. net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6001e78..b3b5cb6 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -926,6 +926,10 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, int err; int flags = 0; + if (!ipv6_addr_any(&fl6->saddr) && + !ipv6_chk_addr(net, &fl6->saddr, NULL, 1)) + return -EINVAL; + /* The correct way to handle this would be to do * ip6_route_get_saddr, and then ip6_route_output; however, * the route-specific preferred source forces the -- 2.10.2