Re: net/ipv6: broken handling of ICMPv6 redirects since Linux 4.18-rc1

On 8/5/21 6:50 AM, Ondřej Caletka wrote:

Dear maintainers,

I think I discovered a bug introduced in 4.18-rc1 and still present in
5.14-rc4. The problem is that Linux does not react on received ICMPv6
redirect - the nexthop visible in the output of "ip -6 route get <dest>"
does not get changed and the data are still sent to the nexthop of the
default gateway. This used to work in kernels up to and including 4.17.19.

Steps to reproduce:
-------------------

I am reproducing the issue in a VM running Ubuntu 20.04 running three
LXD containers. I use tool `redir6` from
[THC-IPv6](https://github.com/vanhauser-thc/thc-ipv6) to perform the
redirect attack. I am testing using vanilla kernels, compiled following
this guide: https://wiki.ubuntu.com/KernelTeam/GitKernelBuild

 1. Download and run [the
VM](https://github.com/RIPE-NCC/ipv6-security-lab)
 2. on hostA, check that an arbitrary IPv6 address is routed through the
default gateway:

    root@hostA:~# ip -6 rou get 2001:db8:bad:dad::1
    2001:db8:bad:dad::1 from :: via fe80::216:3eff:feee:1 dev eth0 proto
ra src 2001:db8:f:1:216:3eff:feee:a metric 100 mtu 1500 pref medium

 3. on hostC, perform the redirect attack and sniff the incoming traffic

    root@hostC:~# redir6 eth0 2001:db8:f:1:216:3eff:feee:a
2001:db8:bad:dad::1 fe80::216:3eff:feee:1 fe80::216:3eff:feee:c
    Sent ICMPv6 redirect for 2001:db8:bad:dad::1
    root@hostC:~# tcpdump -nei eth0 dst host 2001:db8:bad:dad::1

 4. on hostA, check the route again and try to send an echo request to
that address:

    root@hostA:~# ip -6 rou get 2001:db8:bad:dad::1
    2001:db8:bad:dad::1 from :: via fe80::216:3eff:feee:1 dev eth0 proto
ra src 2001:db8:f:1:216:3eff:feee:a metric 100 mtu 1500 pref medium
    root@hostA:~# ping -c 1 2001:db8:bad:dad::1
    PING 2001:db8:bad:dad::1(2001:db8:bad:dad::1) 56 data bytes
    From 2001:db8:f:1::1 icmp_seq=1 Destination unreachable: No route

how does your test differ from:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/tools/testing/selftests/net/icmp_redirect.sh

Can you create a similar script for your test setup?