ipv6: fix source address selection with route leak

By default, an address assigned to the output interface is selected when
the source address is not specified. This is problematic when a route,
configured in a vrf, uses an interface from another vrf (aka route leak).
The original vrf does not own the selected source address.

Let's add a check against the output interface and call the appropriate
function to select the source address.

CC: stable@vger.kernel.org
Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20240710081521.3809742-3-nicolas.dichtel@6wind.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index a18ed24fed948e1e66b011d7bc2b74249d999b6f..6dbdf60b342f6d57ddd6288ce5e4476b413bff60 100644 (file)
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -127,18 +127,26 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args,
 
 static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i,
                                      const struct in6_addr *daddr,
-                                     unsigned int prefs,
+                                     unsigned int prefs, int l3mdev_index,
                                      struct in6_addr *saddr)
 {
+       struct net_device *l3mdev;
+       struct net_device *dev;
+       bool same_vrf;
        int err = 0;
 
-       if (f6i && f6i->fib6_prefsrc.plen) {
+       rcu_read_lock();
+
+       l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
+       if (!f6i || !f6i->fib6_prefsrc.plen || l3mdev)
+               dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
+       same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
+       if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
                *saddr = f6i->fib6_prefsrc.addr;
-       } else {
-               struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
+       else
+               err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);
 
-               err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);
-       }
+       rcu_read_unlock();
 
        return err;
 }

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 27d8725445e3532be2559ae10cb11078e59a0347..784424ac41477611ddbfd49d842589ed67824217 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1124,6 +1124,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
                from = rt ? rcu_dereference(rt->from) : NULL;
                err = ip6_route_get_saddr(net, from, &fl6->daddr,
                                          sk ? READ_ONCE(inet6_sk(sk)->srcprefs) : 0,
+                                         fl6->flowi6_l3mdev,
                                          &fl6->saddr);
                rcu_read_unlock();
 

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8d72ca0b086d7d3e66439c4cc96b592dd7b6217a..c9a9506b714d748bea005637232a7a0730a77e76 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5689,7 +5689,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                                goto nla_put_failure;
        } else if (dest) {
                struct in6_addr saddr_buf;
-               if (ip6_route_get_saddr(net, rt, dest, 0, &saddr_buf) == 0 &&
+               if (ip6_route_get_saddr(net, rt, dest, 0, 0, &saddr_buf) == 0 &&
                    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
                        goto nla_put_failure;
        }