From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============5144173589865896221==" MIME-Version: 1.0 From: Mat Martineau To: mptcp at lists.01.org Subject: [MPTCP] Re: [PATCH net] ipv6: weaken the v4mapped source check Date: Wed, 17 Mar 2021 15:58:54 -0700 Message-ID: In-Reply-To: 20210317165515.1914146-1-kuba@kernel.org X-Status: X-Keywords: X-UID: 8202 --===============5144173589865896221== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, 17 Mar 2021, Jakub Kicinski wrote: > This reverts commit 6af1799aaf3f1bc8defedddfa00df3192445bbf3. > > Commit 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped > source address") introduced an input check against v4mapped addresses. > Use of such addresses on the wire is indeed questionable and not > allowed on public Internet. As the commit pointed out > > https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 > > lists potential issues. > > Unfortunately there are applications which use v4mapped addresses, > and breaking them is a clear regression. For example v4mapped > addresses (or any semi-valid addresses, really) may be used > for uni-direction event streams or packet export. > > Since the issue which sparked the addition of the check was with > TCP and request_socks in particular push the check down to TCPv6 > and DCCP. This restores the ability to receive UDPv6 packets with > v4mapped address as the source. > > Keep using the IPSTATS_MIB_INHDRERRORS statistic to minimize the > user-visible changes. > > Fixes: 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped sourc= e address") > Reported-by: Sunyi Shao > Signed-off-by: Jakub Kicinski > --- > net/dccp/ipv6.c | 5 +++++ > net/ipv6/ip6_input.c | 10 ---------- > net/ipv6/tcp_ipv6.c | 5 +++++ > net/mptcp/subflow.c | 5 +++++ > 4 files changed, 15 insertions(+), 10 deletions(-) Jakub - Thanks for keeping the MPTCP code in sync. The IPv6 and v4mapped MPTCP = selftests still pass. For the MPTCP content: Acked-by: Mat Martineau > > diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c > index 1f73603913f5..2be5c69824f9 100644 > --- a/net/dccp/ipv6.c > +++ b/net/dccp/ipv6.c > @@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, str= uct sk_buff *skb) > if (!ipv6_unicast_destination(skb)) > return 0; /* discard, don't send a reset here */ > > + if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { > + __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); > + return 0; > + } > + > if (dccp_bad_service_code(sk, service)) { > dcb->dccpd_reset_code =3D DCCP_RESET_CODE_BAD_SERVICE_CODE; > goto drop; > diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c > index e9d2a4a409aa..80256717868e 100644 > --- a/net/ipv6/ip6_input.c > +++ b/net/ipv6/ip6_input.c > @@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *= skb, struct net_device *dev, > if (ipv6_addr_is_multicast(&hdr->saddr)) > goto err; > > - /* While RFC4291 is not explicit about v4mapped addresses > - * in IPv6 headers, it seems clear linux dual-stack > - * model can not deal properly with these. > - * Security models could be fooled by ::ffff:127.0.0.1 for example. > - * > - * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 > - */ > - if (ipv6_addr_v4mapped(&hdr->saddr)) > - goto err; > - > skb->transport_header =3D skb->network_header + sizeof(*hdr); > IP6CB(skb)->nhoff =3D offsetof(struct ipv6hdr, nexthdr); > > diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c > index bd44ded7e50c..d0f007741e8e 100644 > --- a/net/ipv6/tcp_ipv6.c > +++ b/net/ipv6/tcp_ipv6.c > @@ -1175,6 +1175,11 @@ static int tcp_v6_conn_request(struct sock *sk, st= ruct sk_buff *skb) > if (!ipv6_unicast_destination(skb)) > goto drop; > > + if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { > + __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); > + return 0; > + } > + > return tcp_conn_request(&tcp6_request_sock_ops, > &tcp_request_sock_ipv6_ops, sk, skb); > > diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c > index 3d47d670e665..d17d39ccdf34 100644 > --- a/net/mptcp/subflow.c > +++ b/net/mptcp/subflow.c > @@ -477,6 +477,11 @@ static int subflow_v6_conn_request(struct sock *sk, = struct sk_buff *skb) > if (!ipv6_unicast_destination(skb)) > goto drop; > > + if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { > + __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); > + return 0; > + } > + > return tcp_conn_request(&mptcp_subflow_request_sock_ops, > &subflow_request_sock_ipv6_ops, sk, skb); > > -- = > 2.30.2 -- Mat Martineau Intel --===============5144173589865896221==--