On 7/8/24 12:15 PM, Nicolas Dichtel wrote:
> By default, an address assigned to the output interface is selected when
> the source address is not specified. This is problematic when a route,
> configured in a vrf, uses an interface from another vrf (aka route leak).
> The original vrf does not own the selected source address.
>
> Let's add a check against the output interface and call the appropriate
> function to select the source address.
>
> CC: stable@xxxxxxxxxxxxxxx
> Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@xxxxxxxxx>
> ---
> include/net/ip6_route.h | 21 ++++++++++++++-------
> net/ipv6/ip6_output.c | 1 +
> net/ipv6/route.c | 2 +-
> 3 files changed, 16 insertions(+), 8 deletions(-)
>
> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
> index a18ed24fed94..667f0a517fd0 100644
> --- a/include/net/ip6_route.h
> +++ b/include/net/ip6_route.h
> @@ -127,18 +127,25 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
>
> static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
> const struct in6_addr *daddr,
> - unsigned int prefs,
> + unsigned int prefs, int l3mdev_index,
> struct in6_addr *saddr)
> {
> + struct net_device *l3mdev;
> + struct net_device *dev;
> + bool same_vrf;
> int err = 0;
>
> - if (f6i && f6i->fib6_prefsrc.plen) {
> - *saddr = f6i->fib6_prefsrc.addr;
> - } else {
> - struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
> + rcu_read_lock();
>
> - err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
> - }
> + l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
> + dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
dev is only needed in the branch and you are now setting all the time.
> + same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
> + if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
> + *saddr = f6i->fib6_prefsrc.addr;
> + else
> + err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
> +
> + rcu_read_unlock();
>
> return err;
> }
Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>
