Re: Linux kernel handling of IPv6 temporary addresses

[George Kargiotakis <kargig () void gr>]

Hello,

On Wed, 16 Jan 2013 18:17:28 +0530 (IST)
P J P <ppandit () redhat com> wrote:

>    Hello George,
>
> +-- On Wed, 16 Jan 2013, George Kargiotakis wrote --+
> | You can reproduce the bug with a new option for flood_router26 that
> has been added to the thc-ipv6 toolkit v2.1. | # ./flood_router26 -A
> eth0
>
>   I tried this, it takes quite a while for other hosts to receive the 
> generated traffic. On the receiving hosts kernel logs
>
> ==
> ...
> ...kernel: Neighbour table overflow.
> ==
>
> no log message from ipv6_create_tempaddr() routine. 
Weird because the '-A' flag of flood_router26 sends very few packets so it shouldn't 
have filled your neighbour table.

what distro/kernel version are you trying ? I'm using latest ubuntu 12.10 with 3.5.7.
The messages I'm mentioning certainly appear upon testing with ubuntu 12.10 live CD for example.

> | I've applied your patch to 3.5.7 and unless I've done something
> wrong, it doesn't seem to work. Actually I can't | get any temporary
> address assignment with it. This is what I get upon booting with your
> patch:
>
>   Ah, very sorry, I missed to say: ift = ipv6_add_addr(...) : in my
> last patch. It remains NULL all the time. Please try this fixed
> version
>
> ===
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 420e563..0aaaa63 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -1046,12 +1046,19 @@ retry:
>       if (ifp->flags & IFA_F_OPTIMISTIC)
>               addr_flags |= IFA_F_OPTIMISTIC;
>  
> -     ift = !max_addresses ||
> -           ipv6_count_addresses(idev) < max_addresses ?
> -             ipv6_add_addr(idev, &addr, tmp_plen,
> -
> ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
> -                           addr_flags) : NULL;
> -     if (!ift || IS_ERR(ift)) {
> +    ift = NULL;
> +    if (!max_addresses || ipv6_count_addresses(idev) < max_addresses)
> +        ift = ipv6_add_addr(idev, &addr, tmp_plen,
> +                        ipv6_addr_type(&addr) & IPV6_ADDR_SCOPE_MASK,
> +                        addr_flags);
> +    if (!ift) {
> +        in6_ifa_put(ifp);
> +        in6_dev_put(idev);
> +        pr_info("%s: ipv6 temporary address upper limit reached\n",
> __func__);
> +        ret = -1;
> +        goto out;
> +    }
> +    else if (IS_ERR(ift)) {
>               in6_ifa_put(ifp);
>               in6_dev_put(idev);
>               pr_info("%s: retry temporary address
> regeneration\n", __func__); ===
>
>
> Thanks so much.
> --
> Prasad J Pandit / Red Hat Security Response Team
> DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602B


Your new patch works "better", but still the main problem hasn't been
eliminated. And I explain myself.

While flooding with RAs the following appears in the dmesg:
[  117.721878] IPv6: ipv6_create_tempaddr: ipv6 temporary address upper limit reached

which is what your patch is supposed to do. But acquired addresses
from flooding all seem to have the tentative flag on:

    inet6 fd00:966f:7996:c731:9191:a3ce:99bc:897e/64 scope global temporary tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966f:7996:c731:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966e:7796:c731:9191:a3ce:99bc:897e/64 scope global temporary tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966e:7796:c731:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966c:7396:c731:9191:a3ce:99bc:897e/64 scope global temporary tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966c:7396:c731:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966b:7196:c731:9191:a3ce:99bc:897e/64 scope global temporary tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec
    inet6 fd00:966b:7196:c731:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 131007sec preferred_lft 65471sec

what I also find wrong here is that all temporary addresses (dynamic) acquired have gotten the same last 64bits.
I don't think this is OK per RFC 4941 even if not explicitly defined there. Every temp. address created should be 
different per prefix from the rest.

use_tempaddr for the iface still has '2' as its value
# cat /proc/sys/net/ipv6/conf/eth0/use_tempaddr 
2

then after taking the interface down and up again even the new addresses acquired still have the tentative flag enabled:
    inet6 2001:db8:f00:f00:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 86371sec preferred_lft 3571sec
    inet6 fdbf:468f:aaa0:474d:222:aaff:fecc:1111/64 scope global tentative dynamic 
       valid_lft 86371sec preferred_lft 3571sec
    inet6 fe80::222:aaff:fecc:1111/64 scope link tentative 
       valid_lft forever preferred_lft forever

dmesg reports:
[  322.195426] IPv6: ipv6_create_tempaddr: regeneration time exceeded - disabled temporary address support

use_tempaddr for the iface now has '-1' as its value though
# cat /proc/sys/net/ipv6/conf/eth0/use_tempaddr 
-1

And so there actually isn't any IPv6 connectivity from then on until a reboot.
Flooding triggers something that corrupts ipv6 functionality.

Best regards,
-- 
George Kargiotakis
https://void.gr
GPG KeyID: 0xE4F4FFE6
GPG Fingerprint: 9EB8 31BE C618 07CE 1B51 818D 4A0A 1BC8 E4F4 FFE6