From: Hannes Frederic Sowa <hidden> Date: 2015-10-13 12:04:34
Hello
On Tue, Oct 13, 2015, at 09:09, Li RongQing wrote:
1. Machine with 2001:1b70:82a8:18:650:65:0:2 address, and receive wrong
icmp packets
root@du1:~# ifconfig
eth10.650 Link encap:Ethernet HWaddr 74:c9:9a:a7:e5:88
inet6 addr: fe80::76c9:9aff:fea7:e588/64 Scope:Link
inet6 addr: 2001:1b70:82a8:18:650:65:0:2/80 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:104 (104.0 B) TX bytes:934 (934.0 B)
2. ICMPv6 packet is as below.
###[ Ethernet ]###
dst = 74:C9:9A:A7:E5:88
src = ae:4f:44:f2:10:cc
type = 0x86dd
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 64
src = 2001:1b70:82a8:18:650:65:0:4
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Packet Too Big ]###
type = Packet too big
code = 0
cksum = None
mtu = 1280
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 255
src = 2001:1b70:82a8:18:650:65:0:2
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Neighbor Discovery - Neighbor Advertisement ]###
type = Neighbor Advertisement
code = 0
cksum = None
R = 1
S = 0
O = 1
res = 0x0
tgt = 2001:1b70:82a8:18:650:65:0:2
##### Test #####
3. Send ICMPv6 with Scapy to trigger fault.
conf.iface='eth1'
eth = Ether(src='ae:4f:44:f2:10:cc', dst='74:C9:9A:A7:E5:88')
base = IPv6(src='2001:1b70:82a8:18:650:65:0:4',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb = ICMPv6PacketTooBig(type=2)
packet = eth/base/ptb
ptb_payload_na_base = IPv6(src='2001:1b70:82a8:18:650:65:0:2',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb_payload_na = ICMPv6ND_NA(type=136,
tgt='2001:1b70:82a8:18:650:65:0:2')
ptb_payload = ptb_payload_na_base/ptb_payload_na
packet = packet/ptb_payload
sendp(packet, iface="eth1.650", count=1)
That is a mess, yes. We should in real life scenarios restrict path mtu
updates to sockets which are bound to the mirrored portion of the packet
which is payload of the icmp payload. :( And not accept source addresses
which are obvious local.
Obviously icmpv6 notify routing engine without checks (how could they)
about the path mtu limitation.
4. route information will enter the faulty state after Wait 600
seconds,
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 7sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 3sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
Urks, it got promoted to a non-local route after removing thus rendering
a remote DoS possibility. This is bad bad bad.
Thanks for the report!
Hannes
From: Hannes Frederic Sowa <hidden> Date: 2015-10-13 14:26:35
On Tue, Oct 13, 2015, at 09:09, Li RongQing wrote:
4. route information will enter the faulty state after Wait 600
seconds,
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 7sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 3sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
Which kernel version did you test this on?
Thanks,
Hannes
From: Li RongQing <hidden> Date: 2015-10-14 06:44:57
On Tue, Oct 13, 2015 at 10:26 PM, Hannes Frederic Sowa
[off-list ref] wrote:
quoted
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
Which kernel version did you test this on?
Thanks,
Hannes
From: Hannes Frederic Sowa <hidden> Date: 2015-10-14 08:44:48
On Wed, Oct 14, 2015, at 08:44, Li RongQing wrote:
On Tue, Oct 13, 2015 at 10:26 PM, Hannes Frederic Sowa
[off-list ref] wrote:
quoted
quoted
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
Which kernel version did you test this on?
Thanks,
Hannes
I think it is all version
I wonder very much because in tests I definitely hit the
static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct
sock *sk,
const struct ipv6hdr *iph, u32 mtu)
{
struct rt6_info *rt6 = (struct rt6_info *)dst;
if (rt6->rt6i_flags & RTF_LOCAL)
return;
RTF_LOCAL check all the times. Which kernel version did you on
specifically?
Thanks,
Hannes
Hi, Rongqing,
Cced Martin KaFai Lau [off-list ref]
It seems you trigger the problem that I met before, here is the link of disucssion:
http://www.spinics.net/lists/netdev/msg314717.html
You can try these patches to check if they resolve your problem:
7035870d1219 | 2015-05-03 | ipv6: Check RTF_LOCAL on rt->rt6i_flags instead of rt->dst.flags
653437d02f1f | 2015-04-28 | ipv6: Stop /128 route from disappearing after pmtu update
thanks,
Sheng
On 10/13/2015 3:09 PM, Li RongQing wrote:
1. Machine with 2001:1b70:82a8:18:650:65:0:2 address, and receive wrong
icmp packets
root@du1:~# ifconfig
eth10.650 Link encap:Ethernet HWaddr 74:c9:9a:a7:e5:88
inet6 addr: fe80::76c9:9aff:fea7:e588/64 Scope:Link
inet6 addr: 2001:1b70:82a8:18:650:65:0:2/80 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:104 (104.0 B) TX bytes:934 (934.0 B)
2. ICMPv6 packet is as below.
###[ Ethernet ]###
dst = 74:C9:9A:A7:E5:88
src = ae:4f:44:f2:10:cc
type = 0x86dd
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 64
src = 2001:1b70:82a8:18:650:65:0:4
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Packet Too Big ]###
type = Packet too big
code = 0
cksum = None
mtu = 1280
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 255
src = 2001:1b70:82a8:18:650:65:0:2
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Neighbor Discovery - Neighbor Advertisement ]###
type = Neighbor Advertisement
code = 0
cksum = None
R = 1
S = 0
O = 1
res = 0x0
tgt = 2001:1b70:82a8:18:650:65:0:2
##### Test #####
3. Send ICMPv6 with Scapy to trigger fault.
conf.iface='eth1'
eth = Ether(src='ae:4f:44:f2:10:cc', dst='74:C9:9A:A7:E5:88')
base = IPv6(src='2001:1b70:82a8:18:650:65:0:4',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb = ICMPv6PacketTooBig(type=2)
packet = eth/base/ptb
ptb_payload_na_base = IPv6(src='2001:1b70:82a8:18:650:65:0:2',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb_payload_na = ICMPv6ND_NA(type=136, tgt='2001:1b70:82a8:18:650:65:0:2')
ptb_payload = ptb_payload_na_base/ptb_payload_na
packet = packet/ptb_payload
sendp(packet, iface="eth1.650", count=1)
4. route information will enter the faulty state after Wait 600 seconds,
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 7sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 3sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
.
From: Li RongQing <hidden> Date: 2015-10-14 09:53:38
On Wed, Oct 14, 2015 at 5:18 PM, Sheng Yong [off-list ref] wrote:
Hi, Rongqing,
Cced Martin KaFai Lau [off-list ref]
It seems you trigger the problem that I met before, here is the link of disucssion:
http://www.spinics.net/lists/netdev/msg314717.html
You can try these patches to check if they resolve your problem:
7035870d1219 | 2015-05-03 | ipv6: Check RTF_LOCAL on rt->rt6i_flags instead of rt->dst.flags
653437d02f1f | 2015-04-28 | ipv6: Stop /128 route from disappearing after pmtu update
thanks,
Sheng
On 10/13/2015 3:09 PM, Li RongQing wrote:
quoted
1. Machine with 2001:1b70:82a8:18:650:65:0:2 address, and receive wrong
icmp packets
root@du1:~# ifconfig
eth10.650 Link encap:Ethernet HWaddr 74:c9:9a:a7:e5:88
inet6 addr: fe80::76c9:9aff:fea7:e588/64 Scope:Link
inet6 addr: 2001:1b70:82a8:18:650:65:0:2/80 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:104 (104.0 B) TX bytes:934 (934.0 B)
2. ICMPv6 packet is as below.
###[ Ethernet ]###
dst = 74:C9:9A:A7:E5:88
src = ae:4f:44:f2:10:cc
type = 0x86dd
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 64
src = 2001:1b70:82a8:18:650:65:0:4
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Packet Too Big ]###
type = Packet too big
code = 0
cksum = None
mtu = 1280
###[ IPv6 ]###
version = 6
tc = 0
fl = 0
plen = None
nh = ICMPv6
hlim = 255
src = 2001:1b70:82a8:18:650:65:0:2
dst = 2001:1b70:82a8:18:650:65:0:2
###[ ICMPv6 Neighbor Discovery - Neighbor Advertisement ]###
type = Neighbor Advertisement
code = 0
cksum = None
R = 1
S = 0
O = 1
res = 0x0
tgt = 2001:1b70:82a8:18:650:65:0:2
##### Test #####
3. Send ICMPv6 with Scapy to trigger fault.
conf.iface='eth1'
eth = Ether(src='ae:4f:44:f2:10:cc', dst='74:C9:9A:A7:E5:88')
base = IPv6(src='2001:1b70:82a8:18:650:65:0:4',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb = ICMPv6PacketTooBig(type=2)
packet = eth/base/ptb
ptb_payload_na_base = IPv6(src='2001:1b70:82a8:18:650:65:0:2',
dst='2001:1b70:82a8:18:650:65:0:2')
ptb_payload_na = ICMPv6ND_NA(type=136, tgt='2001:1b70:82a8:18:650:65:0:2')
ptb_payload = ptb_payload_na_base/ptb_payload_na
packet = packet/ptb_payload
sendp(packet, iface="eth1.650", count=1)
4. route information will enter the faulty state after Wait 600 seconds,
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 7sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
local 2001:1b70:82a8:18:650:65:0:2 dev lo proto none src
2001:1b70:82a8:18:650:65:0:2 metric 0 expires 3sec mtu 1280
root@du1:~# ip route get 2001:1b70:82a8:18:650:65:0:2
2001:1b70:82a8:18:650:65:0:2 dev eth10.650 src
2001:1b70:82a8:18:650:65:0:2 metric 0
cache
root@du1:~#
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
.
From: Li RongQing <hidden> Date: 2015-10-14 10:58:13
On Wed, Oct 14, 2015 at 5:53 PM, Li RongQing [off-list ref] wrote:
On Wed, Oct 14, 2015 at 5:18 PM, Sheng Yong [off-list ref] wrote:
quoted
Hi, Rongqing,
Cced Martin KaFai Lau [off-list ref]
It seems you trigger the problem that I met before, here is the link of disucssion:
http://www.spinics.net/lists/netdev/msg314717.html
You can try these patches to check if they resolve your problem:
7035870d1219 | 2015-05-03 | ipv6: Check RTF_LOCAL on rt->rt6i_flags instead of rt->dst.flags
653437d02f1f | 2015-04-28 | ipv6: Stop /128 route from disappearing after pmtu update
thanks,
Sheng
You are right, these two commits fixed my issue
Thanks
-Roy