Paths

Table of Contentst

Differential D29826

Relax rtsock message restrictions
ClosedPublic
Actions

Authored by melifaro on Apr 18 2021, 8:27 PM.

Details

Reviewers

None

Group Reviewers

network

Commits

rG6f1e5d9169a9: Relax rtsock message restrictions.
rGb31fbebeb3d5: Relax rtsock message restrictions.

Summary

Address multiple issues with strict rtsock message validation.

D28668 "normalisation" approach was based on the assumption that we always have at least "standard".
It turned out to be false - certain older applications like quagga or routed abuse sin[6]_len field and set it to the offset to the first fully-zero bit in the mask. It is impossible to normalize such sockaddrs without reallocation.

With that in mind, change the approach to use a distinct memory buffer for the altered sockaddrs.
This allows supporting the older software while maintaining the guarantee on the "standard" sockaddrs.

Test Plan

bird2-2.0.7

Configs:

protocol static random_s4 {
        disabled;
        ipv4 { export all; };
        route 11.0.0.0/24 blackhole;
        route 11.0.1.0/24 unreachable;
#        route 11.0.2.0/24 prohibit;
        route 11.0.3.0/24 via 10.0.0.9;
#       route 11.0.4.0/24 via 10.0.0.8;
        route 11.0.5.0/24 via "vtnet0";
}

protocol static random_s6 {
        disabled;
        ipv6 { export all; };
        route 2a02:6b8:0:1::/64 blackhole;
        route 2a02:6b8:0:2::/64 unreachable;
        route 2a02:6b8:0:3::/64 via fe80::333%vtnet0;
#       route 2a02:6b8:0:4::/64 via fe80::5054:ff:fe14:e319%vtnet0;
        route 2a02:6b8:0:5::/64 via "vtnet0";
}

Output:

2021-04-18 20:42:37.019 <INFO> Enabling protocol random_s4
2021-04-18 20:42:37.019 <TRACE> random_s4: Starting
2021-04-18 20:42:37.019 <TRACE> random_s4: State changed to up
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.0.0/24 blackhole
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.0.0/24 blackhole
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.1.0/24 unreachable
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.1.0/24 unreachable
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.2.0/24 prohibited
2021-04-18 20:42:37.019 <TRACE> kernel1 < rejected by protocol 11.0.2.0/24 prohibited
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.3.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.3.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.5.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.5.0/24 unicast
2021-04-18 20:42:38.234 <INFO> Enabling protocol random_s6
2021-04-18 20:42:38.234 <TRACE> random_s6: Starting
2021-04-18 20:42:38.234 <TRACE> random_s6: State changed to up
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:1::/64 blackhole
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:1::/64 blackhole
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:2::/64 unreachable
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:2::/64 unreachable
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:3::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:3::/64 unicast
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:5::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:5::/64 unicast
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:6::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:6::/64 unicast


20:40 [0] m@devel2 netstat -4rnW | grep 11.0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        6  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         7   1500     vtnet0
11.0.5.0/24        link#1             U1          8   1500     vtnet0

20:40 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H         81858  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                  53   1500     vtnet0               2
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           41   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2
7            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
8       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2

//

20:41 [0] m@devel2 netstat -6rnW | grep 2a02:6b
2a02:6b8:0:1::/64                 ::1                           UG1B        8  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1        9  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1        10   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1         11   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        12   1500   vtnet0
20:42 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS        81883  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS         7709   1500   vtnet0             5
8            v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
9            v6/gw ::1                           ::1                           GR1           0  16384      lo0             2
10           v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2
11      v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
12           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2

FRR

FRR 7.5.1_1

Configs

ip route 11.0.0.0/24 blackhole
ip route 11.0.1.0/24 reject
ip route 11.0.3.0/24 10.0.0.9
ip route 11.0.5.0/24 vtnet0
ipv6 route 2a02:6b8:0:1::/64 blackhole
ipv6 route 2a02:6b8:0:2::/64 reject
ipv6 route 2a02:6b8:0:3::/64 fe80::333 vtnet0
ipv6 route 2a02:6b8:0:5::/64 vtnet0
ipv6 route 2a02:6b8:0:6::/64 2a01:4f8:13a:70c:ffff::66

Output

20:24 [0] m@devel2 netstat -4rnW
Routing tables

Internet:
Destination        Gateway            Flags   Nhop#    Mtu      Netif Expire
default            10.0.0.1           UGS         4   1500     vtnet0
10.0.0.0/24        link#1             U           2   1500     vtnet0
10.0.0.8           link#1             UHS         3  16384        lo0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        6  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         7   1500     vtnet0
11.0.5.0/24        link#1             U1          8   1500     vtnet0
127.0.0.1          link#2             UH          1  16384        lo0
20:24 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H         81858  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                   9   1500     vtnet0               3
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           37   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2
7            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
8       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2

//

20:36 [0] m@devel2 netstat -6rnW | grep 2a02:6b8
2a02:6b8:0:1::/64                 ::1                           UG1B        8  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1        9  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1        12   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1         10   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        11   1500   vtnet0
20:38 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS        81883  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS         7061   1500   vtnet0             5
8            v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
9            v6/gw ::1                           ::1                           GR1           0  16384      lo0             2
10      v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
11           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2
12           v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2

Quagga 1.2.4

Config

ip route 11.0.0.0/24 Null0
ip route 11.0.1.0/24 lo0 reject
ip route 11.0.3.0/24 10.0.0.9
ip route 11.0.5.0/24 vtnet0
ipv6 route 2a02:6b8:0:1::/64 lo0 blackhole
ipv6 route 2a02:6b8:0:2::/64 lo0 reject
ipv6 route 2a02:6b8:0:3::/64 fe80::333 vtnet0
ipv6 route 2a02:6b8:0:5::/64 vtnet0
ipv6 route 2a02:6b8:0:6::/64 2a01:4f8:13a:70c:ffff::66

21:49 [0] m@devel2 netstat -4rnW | grep 11.0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        8  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         6   1500     vtnet0
11.0.5.0/24        link#1             U1          7   1500     vtnet0
21:49 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H             0  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                 104   1500     vtnet0              16
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           15   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
7       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2
8            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2

21:46 [0] m@devel2 netstat -6rnW | grep ^2a02
2a02:6b8:0:1::/64                 ::1                           UG1B       11  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1       12  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1         8   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1          9   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        10   1500   vtnet0
21:46 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS          752   1500   vtnet0             5
8            v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2
9       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
10           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2
11           v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
12           v6/gw ::1                           ::1                           GR1           0  16384      lo0             2

routed

-- 20:59:50 --
last discovered router 10.0.0.157 via vtnet0 is bad--re-solicit
turn off Router Discovery client
Chg    0.0.0.0         -->10.0.0.157       metric=15 vtnet0 <RDISC>
                                           metric=16 <>
Del #1 10.0.0.0 (mask 0xffffff00)-->10.0.0.157 metric=1  vtnet0 20:59:11
Chg    11.0.0.0 (mask 0xffffff00)-->10.0.0.157 metric=1  vtnet0 20:59:11
                                           metric=16 20:56:50
-- 20:59:57 --
Del    0.0.0.0         -->10.0.0.157       metric=16 vtnet0 20:55:50
-- 20:59:57 --
turn on Router Discovery client using 10.0.0.157 via vtnet0
Add    0.0.0.0         -->10.0.0.157       metric=15 vtnet0 <RDISC>

21:00 [0] m@devel2 netstat -4rnW | grep 10.0.0.157
default            10.0.0.157         UG          4   1500     vtnet0
11.0.0.0/24        10.0.0.157         UG          5   1500     vtnet0


21:01 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H           134  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                   8   1500     vtnet0               2
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.157         G             0   1500     vtnet0               2
5            v4/gw 10.0.0.8           10.0.0.157         G             0   1500     vtnet0               2

Routing tests:

21:12 [1] m@devel2 s kyua test -k /usr/tests/sys/net/routing/Kyuafile
test_rtsock_l3:rtm_add_v4_gu_ifa_ordered_success  ->  passed  [0.124s]
test_rtsock_l3:rtm_add_v4_gw_direct_success  ->  passed  [0.116s]
test_rtsock_l3:rtm_add_v4_no_rtf_host_failure  ->  failed: 1 checks failed; see output for more details  [0.119s]
test_rtsock_l3:rtm_add_v4_temporal1_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_gu_gw_gu_direct_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_gu_ifa_hostroute_success  ->  passed  [0.117s]
test_rtsock_l3:rtm_add_v6_gu_ifa_ordered_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_add_v6_gu_ifa_prefixroute_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_temporal1_success  ->  passed  [0.119s]
test_rtsock_l3:rtm_change_v4_flags_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v4_gw_success  ->  passed  [0.124s]
test_rtsock_l3:rtm_change_v4_mtu_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v6_flags_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v6_gw_success  ->  passed  [0.128s]
test_rtsock_l3:rtm_change_v6_mtu_success  ->  passed  [0.115s]
test_rtsock_l3:rtm_del_v4_gu_ifa_prefixroute_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_del_v4_prefix_nogw_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_del_v6_gu_ifa_hostroute_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_del_v6_gu_ifa_prefixroute_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_del_v6_gu_prefix_nogw_success  ->  passed  [0.116s]
test_rtsock_l3:rtm_get_v4_empty_dst_failure  ->  passed  [0.003s]
test_rtsock_l3:rtm_get_v4_exact_success  ->  passed  [0.129s]
test_rtsock_l3:rtm_get_v4_hostbits_failure  ->  failed: 1 checks failed; see output for more details  [0.118s]
test_rtsock_l3:rtm_get_v4_lpm_success  ->  passed  [0.116s]
test_rtsock_lladdr:rtm_add_v4_gu_lle_success  ->  passed  [0.118s]
test_rtsock_lladdr:rtm_add_v6_gu_lle_success  ->  passed  [0.119s]
test_rtsock_lladdr:rtm_add_v6_ll_lle_success  ->  passed  [0.115s]
test_rtsock_lladdr:rtm_del_v4_gu_lle_success  ->  passed  [0.116s]
test_rtsock_lladdr:rtm_del_v6_gu_lle_success  ->  passed  [0.114s]
test_rtsock_lladdr:rtm_del_v6_ll_lle_success  ->  passed  [0.116s]

Results file id is usr_tests_sys_net_routing.20210420-211213-600214
Results saved to /home/melifaro/.kyua/store/results.usr_tests_sys_net_routing.20210420-211213-600214.db

28/30 passed (2 failed)

hostbits test failures are not relevafnt here

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

melifaro created this revision.Apr 18 2021, 8:27 PM

Herald added subscribers: ae, imp. · View Herald TranscriptApr 18 2021, 8:27 PM

melifaro requested review of this revision.Apr 18 2021, 8:27 PM

Harbormaster completed remote builds in B38675: Diff 87672.Apr 18 2021, 8:27 PM

melifaro edited the test plan for this revision. (Show Details)Apr 18 2021, 8:34 PM

melifaro edited the test plan for this revision. (Show Details)

melifaro edited the test plan for this revision. (Show Details)Apr 18 2021, 8:43 PM

melifaro edited the test plan for this revision. (Show Details)

melifaro edited the test plan for this revision. (Show Details)Apr 18 2021, 8:50 PM

melifaro edited the test plan for this revision. (Show Details)Apr 18 2021, 9:49 PM

Fix quagga.

Harbormaster completed remote builds in B38676: Diff 87675.Apr 18 2021, 10:06 PM

melifaro edited the summary of this revision. (Show Details)Apr 19 2021, 8:12 PM

melifaro added a reviewer: network.

melifaro edited the summary of this revision. (Show Details)Apr 19 2021, 8:14 PM

Reflect committed changes.

Harbormaster completed remote builds in B38694: Diff 87744.Apr 19 2021, 8:51 PM

melifaro edited the test plan for this revision. (Show Details)Apr 20 2021, 9:01 PM

melifaro edited the test plan for this revision. (Show Details)Apr 20 2021, 9:14 PM

This revision was not accepted when it landed; it landed in state Needs Review.Apr 20 2021, 9:35 PM

Closed by commit rGb31fbebeb3d5: Relax rtsock message restrictions. (authored by melifaro). · Explain Why

This revision was automatically updated to reflect the committed changes.

melifaro added a commit: rGb31fbebeb3d5: Relax rtsock message restrictions..

melifaro mentioned this in D29958: [rtsock] Enforce netmask/RTF_HOST consistency.Apr 23 2021, 10:00 PM

melifaro mentioned this in rG5d1403a79a3e: [rtsock] Enforce netmask/RTF_HOST consistency..Apr 24 2021, 11:04 PM

melifaro added a commit: rG6f1e5d9169a9: Relax rtsock message restrictions..Apr 26 2021, 9:13 AM

melifaro mentioned this in rG3fd9848f1593: [rtsock] Enforce netmask/RTF_HOST consistency..May 4 2021, 9:43 PM

Revision Contents
Changeset List

Path

Size

sys/

net/

rtsock.c

271 lines

Diff 87839

View Options

Relax rtsock message restrictionsClosedPublicActions