Page MenuHomeFreeBSD

Relax rtsock message restrictions
ClosedPublic

Authored by melifaro on Apr 18 2021, 8:27 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Mar 27, 3:48 PM
Unknown Object (File)
Feb 18 2024, 7:39 AM
Unknown Object (File)
Feb 10 2024, 9:30 PM
Unknown Object (File)
Feb 10 2024, 9:30 PM
Unknown Object (File)
Feb 9 2024, 10:15 AM
Unknown Object (File)
Feb 1 2024, 8:11 AM
Unknown Object (File)
Dec 22 2023, 2:09 PM
Unknown Object (File)
Dec 12 2023, 9:18 AM
Subscribers

Details

Summary

Address multiple issues with strict rtsock message validation.

D28668 "normalisation" approach was based on the assumption that we always have at least "standard".
It turned out to be false - certain older applications like quagga or routed abuse sin[6]_len field and set it to the offset to the first fully-zero bit in the mask. It is impossible to normalize such sockaddrs without reallocation.

With that in mind, change the approach to use a distinct memory buffer for the altered sockaddrs.
This allows supporting the older software while maintaining the guarantee on the "standard" sockaddrs.

Test Plan

bird2-2.0.7

Configs:

protocol static random_s4 {
        disabled;
        ipv4 { export all; };
        route 11.0.0.0/24 blackhole;
        route 11.0.1.0/24 unreachable;
#        route 11.0.2.0/24 prohibit;
        route 11.0.3.0/24 via 10.0.0.9;
#       route 11.0.4.0/24 via 10.0.0.8;
        route 11.0.5.0/24 via "vtnet0";
}

protocol static random_s6 {
        disabled;
        ipv6 { export all; };
        route 2a02:6b8:0:1::/64 blackhole;
        route 2a02:6b8:0:2::/64 unreachable;
        route 2a02:6b8:0:3::/64 via fe80::333%vtnet0;
#       route 2a02:6b8:0:4::/64 via fe80::5054:ff:fe14:e319%vtnet0;
        route 2a02:6b8:0:5::/64 via "vtnet0";
}

Output:

2021-04-18 20:42:37.019 <INFO> Enabling protocol random_s4
2021-04-18 20:42:37.019 <TRACE> random_s4: Starting
2021-04-18 20:42:37.019 <TRACE> random_s4: State changed to up
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.0.0/24 blackhole
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.0.0/24 blackhole
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.1.0/24 unreachable
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.1.0/24 unreachable
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.2.0/24 prohibited
2021-04-18 20:42:37.019 <TRACE> kernel1 < rejected by protocol 11.0.2.0/24 prohibited
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.3.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.3.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> random_s4 > added [best] 11.0.5.0/24 unicast
2021-04-18 20:42:37.019 <TRACE> kernel1 < added 11.0.5.0/24 unicast
2021-04-18 20:42:38.234 <INFO> Enabling protocol random_s6
2021-04-18 20:42:38.234 <TRACE> random_s6: Starting
2021-04-18 20:42:38.234 <TRACE> random_s6: State changed to up
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:1::/64 blackhole
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:1::/64 blackhole
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:2::/64 unreachable
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:2::/64 unreachable
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:3::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:3::/64 unicast
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:5::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:5::/64 unicast
2021-04-18 20:42:38.234 <TRACE> random_s6 > added [best] 2a02:6b8:0:6::/64 unicast
2021-04-18 20:42:38.234 <TRACE> kernel2 < added 2a02:6b8:0:6::/64 unicast


20:40 [0] m@devel2 netstat -4rnW | grep 11.0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        6  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         7   1500     vtnet0
11.0.5.0/24        link#1             U1          8   1500     vtnet0

20:40 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H         81858  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                  53   1500     vtnet0               2
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           41   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2
7            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
8       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2

//

20:41 [0] m@devel2 netstat -6rnW | grep 2a02:6b
2a02:6b8:0:1::/64                 ::1                           UG1B        8  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1        9  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1        10   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1         11   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        12   1500   vtnet0
20:42 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS        81883  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS         7709   1500   vtnet0             5
8            v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
9            v6/gw ::1                           ::1                           GR1           0  16384      lo0             2
10           v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2
11      v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
12           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2

FRR

FRR 7.5.1_1

Configs

ip route 11.0.0.0/24 blackhole
ip route 11.0.1.0/24 reject
ip route 11.0.3.0/24 10.0.0.9
ip route 11.0.5.0/24 vtnet0
ipv6 route 2a02:6b8:0:1::/64 blackhole
ipv6 route 2a02:6b8:0:2::/64 reject
ipv6 route 2a02:6b8:0:3::/64 fe80::333 vtnet0
ipv6 route 2a02:6b8:0:5::/64 vtnet0
ipv6 route 2a02:6b8:0:6::/64 2a01:4f8:13a:70c:ffff::66

Output

20:24 [0] m@devel2 netstat -4rnW
Routing tables

Internet:
Destination        Gateway            Flags   Nhop#    Mtu      Netif Expire
default            10.0.0.1           UGS         4   1500     vtnet0
10.0.0.0/24        link#1             U           2   1500     vtnet0
10.0.0.8           link#1             UHS         3  16384        lo0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        6  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         7   1500     vtnet0
11.0.5.0/24        link#1             U1          8   1500     vtnet0
127.0.0.1          link#2             UH          1  16384        lo0
20:24 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H         81858  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                   9   1500     vtnet0               3
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           37   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2
7            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
8       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2

//

20:36 [0] m@devel2 netstat -6rnW | grep 2a02:6b8
2a02:6b8:0:1::/64                 ::1                           UG1B        8  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1        9  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1        12   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1         10   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        11   1500   vtnet0
20:38 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS        81883  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS         7061   1500   vtnet0             5
8            v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
9            v6/gw ::1                           ::1                           GR1           0  16384      lo0             2
10      v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
11           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2
12           v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2

Quagga 1.2.4

Config

ip route 11.0.0.0/24 Null0
ip route 11.0.1.0/24 lo0 reject
ip route 11.0.3.0/24 10.0.0.9
ip route 11.0.5.0/24 vtnet0
ipv6 route 2a02:6b8:0:1::/64 lo0 blackhole
ipv6 route 2a02:6b8:0:2::/64 lo0 reject
ipv6 route 2a02:6b8:0:3::/64 fe80::333 vtnet0
ipv6 route 2a02:6b8:0:5::/64 vtnet0
ipv6 route 2a02:6b8:0:6::/64 2a01:4f8:13a:70c:ffff::66
21:49 [0] m@devel2 netstat -4rnW | grep 11.0
11.0.0.0/24        127.0.0.1          UG1B        5  16384        lo0
11.0.1.0/24        127.0.0.1          UGR1        8  16384        lo0
11.0.3.0/24        10.0.0.9           UG1         6   1500     vtnet0
11.0.5.0/24        link#1             U1          7   1500     vtnet0
21:49 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H             0  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                 104   1500     vtnet0              16
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.1           GS           15   1500     vtnet0               2
5            v4/gw 127.0.0.1          127.0.0.1          G1B           0  16384        lo0               2
6            v4/gw 10.0.0.8           10.0.0.9           G1            0   1500     vtnet0               2
7       v4/resolve 10.0.0.8           vtnet0/resolve     1             0   1500     vtnet0               2
8            v4/gw 127.0.0.1          127.0.0.1          GR1           0  16384        lo0               2

21:46 [0] m@devel2 netstat -6rnW | grep ^2a02
2a02:6b8:0:1::/64                 ::1                           UG1B       11  16384      lo0
2a02:6b8:0:2::/64                 ::1                           UGR1       12  16384      lo0
2a02:6b8:0:3::/64                 fe80::333%vtnet0              UG1         8   1500   vtnet0
2a02:6b8:0:5::/64                 link#1                        U1          9   1500   vtnet0
2a02:6b8:0:6::/64                 2a01:4f8:13a:70c:ffff::66     UG1        10   1500   vtnet0
21:46 [0] m@devel2 netstat -6onW
Nexthop data

Internet6:
Idx   Type         IFA                           Gateway                        Flags      Use Mtu       Netif   Addrif Refcnt Prepend
1       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0             2
2       v6/resolve fe80::1%lo0                   lo0/resolve                   HS            0  16384      lo0             2
3       v6/resolve fe80::1%lo0                   lo0/resolve                                 0  16384      lo0             2
4       v6/resolve ::1                           lo0/resolve                   HS            0  16384      lo0  vtnet0     3
5       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve                             0   1500   vtnet0             3
6            v6/gw ::1                           ::1                           GRS           0  16384      lo0             5
7            v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::1      GS          752   1500   vtnet0             5
8            v6/gw fe80::5054:ff:fe14:e319%vtnet0 fe80::333%vtnet0             G1            0   1500   vtnet0             2
9       v6/resolve fe80::5054:ff:fe14:e319%vtnet0 vtnet0/resolve               1             0   1500   vtnet0             2
10           v6/gw 2a01:4f8:13a:70c:ffff::8      2a01:4f8:13a:70c:ffff::66     G1            0   1500   vtnet0             2
11           v6/gw ::1                           ::1                           G1B           0  16384      lo0             2
12           v6/gw ::1                           ::1                           GR1           0  16384      lo0             2

routed

-- 20:59:50 --
last discovered router 10.0.0.157 via vtnet0 is bad--re-solicit
turn off Router Discovery client
Chg    0.0.0.0         -->10.0.0.157       metric=15 vtnet0 <RDISC>
                                           metric=16 <>
Del #1 10.0.0.0 (mask 0xffffff00)-->10.0.0.157 metric=1  vtnet0 20:59:11
Chg    11.0.0.0 (mask 0xffffff00)-->10.0.0.157 metric=1  vtnet0 20:59:11
                                           metric=16 20:56:50
-- 20:59:57 --
Del    0.0.0.0         -->10.0.0.157       metric=16 vtnet0 20:55:50
-- 20:59:57 --
turn on Router Discovery client using 10.0.0.157 via vtnet0
Add    0.0.0.0         -->10.0.0.157       metric=15 vtnet0 <RDISC>
21:00 [0] m@devel2 netstat -4rnW | grep 10.0.0.157
default            10.0.0.157         UG          4   1500     vtnet0
11.0.0.0/24        10.0.0.157         UG          5   1500     vtnet0


21:01 [0] m@devel2 netstat -4onW
Nexthop data

Internet:
Idx   Type         IFA                Gateway             Flags      Use Mtu         Netif     Addrif Refcnt Prepend
1       v4/resolve 127.0.0.1          lo0/resolve        H           134  16384        lo0               2
2       v4/resolve 10.0.0.8           vtnet0/resolve                   8   1500     vtnet0               2
3       v4/resolve 127.0.0.1          lo0/resolve        HS            0  16384        lo0    vtnet0     2
4            v4/gw 10.0.0.8           10.0.0.157         G             0   1500     vtnet0               2
5            v4/gw 10.0.0.8           10.0.0.157         G             0   1500     vtnet0               2

Routing tests:

21:12 [1] m@devel2 s kyua test -k /usr/tests/sys/net/routing/Kyuafile
test_rtsock_l3:rtm_add_v4_gu_ifa_ordered_success  ->  passed  [0.124s]
test_rtsock_l3:rtm_add_v4_gw_direct_success  ->  passed  [0.116s]
test_rtsock_l3:rtm_add_v4_no_rtf_host_failure  ->  failed: 1 checks failed; see output for more details  [0.119s]
test_rtsock_l3:rtm_add_v4_temporal1_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_gu_gw_gu_direct_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_gu_ifa_hostroute_success  ->  passed  [0.117s]
test_rtsock_l3:rtm_add_v6_gu_ifa_ordered_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_add_v6_gu_ifa_prefixroute_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_add_v6_temporal1_success  ->  passed  [0.119s]
test_rtsock_l3:rtm_change_v4_flags_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v4_gw_success  ->  passed  [0.124s]
test_rtsock_l3:rtm_change_v4_mtu_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v6_flags_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_change_v6_gw_success  ->  passed  [0.128s]
test_rtsock_l3:rtm_change_v6_mtu_success  ->  passed  [0.115s]
test_rtsock_l3:rtm_del_v4_gu_ifa_prefixroute_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_del_v4_prefix_nogw_success  ->  passed  [0.118s]
test_rtsock_l3:rtm_del_v6_gu_ifa_hostroute_success  ->  passed  [0.120s]
test_rtsock_l3:rtm_del_v6_gu_ifa_prefixroute_success  ->  passed  [0.121s]
test_rtsock_l3:rtm_del_v6_gu_prefix_nogw_success  ->  passed  [0.116s]
test_rtsock_l3:rtm_get_v4_empty_dst_failure  ->  passed  [0.003s]
test_rtsock_l3:rtm_get_v4_exact_success  ->  passed  [0.129s]
test_rtsock_l3:rtm_get_v4_hostbits_failure  ->  failed: 1 checks failed; see output for more details  [0.118s]
test_rtsock_l3:rtm_get_v4_lpm_success  ->  passed  [0.116s]
test_rtsock_lladdr:rtm_add_v4_gu_lle_success  ->  passed  [0.118s]
test_rtsock_lladdr:rtm_add_v6_gu_lle_success  ->  passed  [0.119s]
test_rtsock_lladdr:rtm_add_v6_ll_lle_success  ->  passed  [0.115s]
test_rtsock_lladdr:rtm_del_v4_gu_lle_success  ->  passed  [0.116s]
test_rtsock_lladdr:rtm_del_v6_gu_lle_success  ->  passed  [0.114s]
test_rtsock_lladdr:rtm_del_v6_ll_lle_success  ->  passed  [0.116s]

Results file id is usr_tests_sys_net_routing.20210420-211213-600214
Results saved to /home/melifaro/.kyua/store/results.usr_tests_sys_net_routing.20210420-211213-600214.db

28/30 passed (2 failed)

hostbits test failures are not relevafnt here

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 38675
Build 35564: arc lint + arc unit

Event Timeline

melifaro edited the test plan for this revision. (Show Details)
melifaro edited the test plan for this revision. (Show Details)
melifaro edited the test plan for this revision. (Show Details)

Fix quagga.

melifaro added a reviewer: network.
melifaro edited the summary of this revision. (Show Details)

Reflect committed changes.

This revision was not accepted when it landed; it landed in state Needs Review.Apr 20 2021, 9:35 PM
This revision was automatically updated to reflect the committed changes.