On 7/8/24 12:15 PM, Nicolas Dichtel wrote:
By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address.
Let's add a check against the output interface and call the appropriate function to select the source address.
CC: stable@vger.kernel.org Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6") Signed-off-by: Nicolas Dichtel nicolas.dichtel@6wind.com
include/net/ip6_route.h | 21 ++++++++++++++------- net/ipv6/ip6_output.c | 1 + net/ipv6/route.c | 2 +- 3 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h index a18ed24fed94..667f0a517fd0 100644 --- a/include/net/ip6_route.h +++ b/include/net/ip6_route.h @@ -127,18 +127,25 @@ void rt6_age_exceptions(struct fib6_info *f6i, struct fib6_gc_args *gc_args, static inline int ip6_route_get_saddr(struct net *net, struct fib6_info *f6i, const struct in6_addr *daddr,
unsigned int prefs,
unsigned int prefs, int l3mdev_index, struct in6_addr *saddr){
- struct net_device *l3mdev;
- struct net_device *dev;
- bool same_vrf; int err = 0;
- if (f6i && f6i->fib6_prefsrc.plen) {
*saddr = f6i->fib6_prefsrc.addr;- } else {
struct net_device *dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
- rcu_read_lock();
err = ipv6_dev_get_saddr(net, dev, daddr, prefs, saddr);- }
- l3mdev = dev_get_by_index_rcu(net, l3mdev_index);
- dev = f6i ? fib6_info_nh_dev(f6i) : NULL;
dev is only needed in the branch and you are now setting all the time.
- same_vrf = !l3mdev || l3mdev_master_dev_rcu(dev) == l3mdev;
- if (f6i && f6i->fib6_prefsrc.plen && same_vrf)
*saddr = f6i->fib6_prefsrc.addr;- else
err = ipv6_dev_get_saddr(net, same_vrf ? dev : l3mdev, daddr, prefs, saddr);- rcu_read_unlock();
return err; }
Reviewed-by: David Ahern dsahern@kernel.org