linux-stable.git/net/ipv6/ip6_output.c, branch linux-3.1.y

net: introduce DST_NOPEER dst flag

2012-01-06T22:17:31+00:00

[ Upstream commit e688a604807647c9450f9c12a7cb6d027150a895 ]

Chris Boot reported crashes occurring in ipv6_select_ident().

[  461.457562] RIP: 0010:[]  []
ipv6_select_ident+0x31/0xa7

[  461.578229] Call Trace:
[  461.580742] 
[  461.582870]  [] ? udp6_ufo_fragment+0x124/0x1a2
[  461.589054]  [] ? ipv6_gso_segment+0xc0/0x155
[  461.595140]  [] ? skb_gso_segment+0x208/0x28b
[  461.601198]  [] ? ipv6_confirm+0x146/0x15e
[nf_conntrack_ipv6]
[  461.608786]  [] ? nf_iterate+0x41/0x77
[  461.614227]  [] ? dev_hard_start_xmit+0x357/0x543
[  461.620659]  [] ? nf_hook_slow+0x73/0x111
[  461.626440]  [] ? br_parse_ip_options+0x19a/0x19a
[bridge]
[  461.633581]  [] ? dev_queue_xmit+0x3af/0x459
[  461.639577]  [] ? br_dev_queue_push_xmit+0x72/0x76
[bridge]
[  461.646887]  [] ? br_nf_post_routing+0x17d/0x18f
[bridge]
[  461.653997]  [] ? nf_iterate+0x41/0x77
[  461.659473]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.665485]  [] ? nf_hook_slow+0x73/0x111
[  461.671234]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.677299]  [] ?
nf_bridge_update_protocol+0x20/0x20 [bridge]
[  461.684891]  [] ? nf_ct_zone+0xa/0x17 [nf_conntrack]
[  461.691520]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.697572]  [] ? NF_HOOK.constprop.8+0x3c/0x56
[bridge]
[  461.704616]  [] ?
nf_bridge_push_encap_header+0x1c/0x26 [bridge]
[  461.712329]  [] ? br_nf_forward_finish+0x8a/0x95
[bridge]
[  461.719490]  [] ?
nf_bridge_pull_encap_header+0x1c/0x27 [bridge]
[  461.727223]  [] ? br_nf_forward_ip+0x1c0/0x1d4 [bridge]
[  461.734292]  [] ? nf_iterate+0x41/0x77
[  461.739758]  [] ? __br_deliver+0xa0/0xa0 [bridge]
[  461.746203]  [] ? nf_hook_slow+0x73/0x111
[  461.751950]  [] ? __br_deliver+0xa0/0xa0 [bridge]
[  461.758378]  [] ? NF_HOOK.constprop.4+0x56/0x56
[bridge]

This is caused by bridge netfilter special dst_entry (fake_rtable), a
special shared entry, where attaching an inetpeer makes no sense.

Problem is present since commit 87c48fa3b46 (ipv6: make fragment
identifications less predictable)

Introduce DST_NOPEER dst flag and make sure ipv6_select_ident() and
__ip_select_ident() fallback to the 'no peer attached' handling.

Reported-by: Chris Boot 
Tested-by: Chris Boot 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: fix NULL dereferences in check_peer_redir()

2011-08-03T10:34:12+00:00

Gergely Kalman reported crashes in check_peer_redir().

It appears commit f39925dbde778 (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.

Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.

Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.

As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)

Many thanks to Gergely for providing a pretty report pointing to the
bug.

Reported-by: Gergely Kalman 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ipv6: make fragment identifications less predictable

2011-07-22T04:25:58+00:00

IPv6 fragment identification generation is way beyond what we use for
IPv4 : It uses a single generator. Its not scalable and allows DOS
attacks.

Now inetpeer is IPv6 aware, we can use it to provide a more secure and
scalable frag ident generator (per destination, instead of system wide)

This patch :
1) defines a new secure_ipv6_id() helper
2) extends inet_getid() to provide 32bit results
3) extends ipv6_select_ident() with a new dest parameter

Reported-by: Fernando Gont 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Abstract dst->neighbour accesses behind helpers.

2011-07-18T06:11:35+00:00

dst_{get,set}_neighbour()

Signed-off-by: David S. Miller

net: Create and use new helper, neigh_output().

2011-07-17T00:26:00+00:00

Signed-off-by: David S. Miller

ipv6: Use calculated 'neigh' instead of re-evaluating dst->neighbour

2011-07-16T21:30:47+00:00

Signed-off-by: David S. Miller

net: Embed hh_cache inside of struct neighbour.

2011-07-14T14:53:20+00:00

Now that there is a one-to-one correspondance between neighbour
and hh_cache entries, we no longer need:

1) dynamic allocation
2) attachment to dst->hh
3) refcounting

Initialization of the hh_cache entry is indicated by hh_len
being non-zero, and such initialization is always done with
the neighbour's lock held as a writer.

Signed-off-by: David S. Miller

inet: Decrease overhead of on-stack inet_cork.

2011-05-06T22:37:57+00:00

When we fast path datagram sends to avoid locking by putting
the inet_cork on the stack we use up lots of space that isn't
necessary.

This is because inet_cork contains a "struct flowi" which isn't
used in these code paths.

Split inet_cork to two parts, "inet_cork" and "inet_cork_full".
Only the latter of which has the "struct flowi" and is what is
stored in inet_sock.

Signed-off-by: David S. Miller 
Acked-by: Eric Dumazet

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ipv6: RTA_PREFSRC support for ipv6 route source address selection

2011-04-15T22:44:37+00:00

[ipv6] Add support for RTA_PREFSRC

This patch allows a user to select the preferred source address
for a specific IPv6-Route. It can be set via a netlink message
setting RTA_PREFSRC to a valid IPv6 address which must be
up on the device the route will be bound to.

Signed-off-by: Daniel Walter 
Signed-off-by: David S. Miller