From patchwork Tue Oct 24 11:27:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Schwab X-Patchwork-Id: 78460 X-Patchwork-Delegate: fweimer@redhat.com Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id C44303858C2B for ; Tue, 24 Oct 2023 11:27:20 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by sourceware.org (Postfix) with ESMTPS id 0F3EB3858CDA for ; Tue, 24 Oct 2023 11:27:05 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 0F3EB3858CDA Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 0F3EB3858CDA Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2001:67c:2178:6::1d ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1698146828; cv=none; b=MygTWPybtBZ18OJzxy8eiq1oCvoDE2ZKao00VPLN3NXv6FlBKLbvSb9f1U2CpKivzs4Nxp6VVazGhCXiesoYjdYOmAbX8r2AsgUrlqnuciRg9JxX75mWrQTov53qvvLsTT734RYBBxQuOXkjlZnWuIpFXQYk2OX4Bm4NQyeMkmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1698146828; c=relaxed/simple; bh=6YerCmWZkffVwPadJaQElTu5stagP8uynKcm5WctgyI=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=vJBEgyOaAsy43CC7rdX7lAobrv6wL0nIagyIOqYme3phOYbnGWpzDdE5wX7Ik+qTNICcLFgZEX/EIYOHsvaalV1OM2X1cxFPRCKr5LFnzIjogF9yyPYWF/7RZvLIToUmK7N1pAGj7SHXM5WY/BJ4gnOgA1gVldGOyo4EYRB/D7Y= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id 185C71FD90 for ; Tue, 24 Oct 2023 11:27:04 +0000 (UTC) Received: from hawking.nue2.suse.org (unknown [10.168.4.11]) by relay2.suse.de (Postfix) with ESMTP id D1F532D1C4 for ; Tue, 24 Oct 2023 11:27:03 +0000 (UTC) Received: by hawking.nue2.suse.org (Postfix, from userid 17005) id E4DBC4A04F6; Tue, 24 Oct 2023 13:27:03 +0200 (CEST) From: Andreas Schwab To: libc-alpha@sourceware.org Subject: [PATCH] Update getaddrinfo to RFC 6724 (bug 29496) X-Yow: UH-OH!! We're out of AUTOMOBILE PARTS and RUBBER GOODS! Date: Tue, 24 Oct 2023 13:27:03 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Spamd-Bar: +++++ Authentication-Results: smtp-out2.suse.de; dkim=none; dmarc=none; spf=softfail (smtp-out2.suse.de: 149.44.160.134 is neither permitted nor denied by domain of schwab@suse.de) smtp.mailfrom=schwab@suse.de X-Rspamd-Server: rspamd2 X-Spamd-Result: default: False [5.59 / 50.00]; ARC_NA(0.00)[]; BAYES_SPAM(5.10)[99.99%]; FROM_HAS_DN(0.00)[]; RWL_MAILSPIKE_GOOD(0.00)[149.44.160.134:from]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-3.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[libc-alpha@sourceware.org]; TO_DN_NONE(0.00)[]; R_SPF_SOFTFAIL(0.60)[~all:c]; RCPT_COUNT_ONE(0.00)[1]; DMARC_NA(0.20)[suse.de]; VIOLATED_DIRECT_SPF(3.50)[]; MX_GOOD(-0.01)[]; NEURAL_HAM_SHORT(-1.00)[-1.000]; RCVD_NO_TLS_LAST(0.10)[]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.20)[]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_TWO(0.00)[2]; MID_RHS_MATCH_FROM(0.00)[] X-Spam-Score: 5.59 X-Rspamd-Queue-Id: 185C71FD90 X-Spam-Status: No, score=-8.8 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+patchwork=sourceware.org@sourceware.org RFC 6724 is the successor of RFC 3484 and updated the default policy table and the address selection rules. The policy table contains more entries to depreference deprecated prefixes. The longest prefix match rule has been updated to only compare the prefix part of the addresses, so that addresses on the same subnet are no longer reordered. --- nss/Makefile | 6 +- nss/getaddrinfo.c | 107 ++++++++++++++--------- nss/{tst-rfc3484-2.c => tst-rfc6724-2.c} | 6 +- nss/{tst-rfc3484-3.c => tst-rfc6724-3.c} | 4 +- nss/{tst-rfc3484.c => tst-rfc6724.c} | 6 +- posix/gai.conf | 48 +++++----- 6 files changed, 100 insertions(+), 77 deletions(-) rename nss/{tst-rfc3484-2.c => tst-rfc6724-2.c} (95%) rename nss/{tst-rfc3484-3.c => tst-rfc6724-3.c} (96%) rename nss/{tst-rfc3484.c => tst-rfc6724.c} (95%) diff --git a/nss/Makefile b/nss/Makefile index 213b68720b..9162912264 100644 --- a/nss/Makefile +++ b/nss/Makefile @@ -306,9 +306,9 @@ tests-static = tst-field tests-internal := \ tst-field \ - tst-rfc3484 \ - tst-rfc3484-2 \ - tst-rfc3484-3 \ + tst-rfc6724 \ + tst-rfc6724-2 \ + tst-rfc6724-3 \ # tests-internal tests := \ diff --git a/nss/getaddrinfo.c b/nss/getaddrinfo.c index 531124958d..6902a47224 100644 --- a/nss/getaddrinfo.c +++ b/nss/getaddrinfo.c @@ -1311,7 +1311,7 @@ static const struct prefixentry *labels; /* Default labels. */ static const struct prefixentry default_labels[] = { - /* See RFC 3484 for the details. */ + /* See RFC 6724 for the details. */ { { .__in6_u = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 } } @@ -1328,26 +1328,22 @@ static const struct prefixentry default_labels[] = = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 } } }, 96, 4 }, - /* The next two entries differ from RFC 3484. We need to treat - IPv6 site-local addresses special because they are never NATed, - unlike site-locale IPv4 addresses. If this would not happen, on - machines which have only IPv4 and IPv6 site-local addresses, the - sorting would prefer the IPv6 site-local addresses, causing - unnecessary delays when trying to connect to a global IPv6 address - through a site-local IPv6 address. */ + { { .__in6_u + = { .__u6_addr8 = { 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 32, 5 }, { { .__in6_u = { .__u6_addr8 = { 0xfe, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } - }, 10, 5 }, + }, 10, 11 }, { { .__in6_u - = { .__u6_addr8 = { 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + = { .__u6_addr8 = { 0x3f, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } - }, 7, 6 }, - /* Additional rule for Teredo tunnels. */ + }, 16, 12 }, { { .__in6_u - = { .__u6_addr8 = { 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + = { .__u6_addr8 = { 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } - }, 32, 7 }, + }, 7, 13 }, { { .__in6_u = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } @@ -1361,23 +1357,39 @@ static const struct prefixentry *precedence; /* The default precedences. */ static const struct prefixentry default_precedence[] = { - /* See RFC 3484 for the details. */ + /* See RFC 6724 for the details. */ { { .__in6_u = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 } } }, 128, 50 }, + { { .__in6_u + = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 } } + }, 96, 35 }, { { .__in6_u = { .__u6_addr8 = { 0x20, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } }, 16, 30 }, { { .__in6_u - = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } - }, 96, 20 }, + = { .__u6_addr8 = { 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 32, 5 }, + { { .__in6_u + = { .__u6_addr8 = { 0xfc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 7, 3 }, { { .__in6_u = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 } } - }, 96, 10 }, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 96, 1 }, + { { .__in6_u + = { .__u6_addr8 = { 0xfe, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 10, 1 }, + { { .__in6_u + = { .__u6_addr8 = { 0x3f, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } + }, 16, 1 }, { { .__in6_u = { .__u6_addr8 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } } @@ -1460,7 +1472,9 @@ fls (uint32_t a) { uint32_t mask; int n; - for (n = 0, mask = 1 << 31; n < 32; mask >>= 1, ++n) + if (a == 0) + return 0; + for (n = 0, mask = 1u << 31; n < 32; mask >>= 1, ++n) if ((a & mask) != 0) break; return n; @@ -1468,7 +1482,7 @@ fls (uint32_t a) static int -rfc3484_sort (const void *p1, const void *p2, void *arg) +rfc6724_sort (const void *p1, const void *p2, void *arg) { const size_t idx1 = *(const size_t *) p1; const size_t idx2 = *(const size_t *) p2; @@ -1649,7 +1663,7 @@ rfc3484_sort (const void *p1, const void *p2, void *arg) in_addr_t netmask1 = 0xffffffffu << (32 - a1->prefixlen); if ((in1_src_addr & netmask1) == (in1_dst_addr & netmask1)) - bit1 = fls (in1_dst_addr ^ in1_src_addr); + bit1 = a1->prefixlen; struct sockaddr_in *in2_dst = (struct sockaddr_in *) a2->dest_addr->ai_addr; @@ -1660,7 +1674,7 @@ rfc3484_sort (const void *p1, const void *p2, void *arg) in_addr_t netmask2 = 0xffffffffu << (32 - a2->prefixlen); if ((in2_src_addr & netmask2) == (in2_dst_addr & netmask2)) - bit2 = fls (in2_dst_addr ^ in2_src_addr); + bit2 = a2->prefixlen; } else if (a1->dest_addr->ai_family == PF_INET6) { @@ -1679,18 +1693,33 @@ rfc3484_sort (const void *p1, const void *p2, void *arg) int i; for (i = 0; i < 4; ++i) - if (in1_dst->sin6_addr.s6_addr32[i] - != in1_src->sin6_addr.s6_addr32[i] - || (in2_dst->sin6_addr.s6_addr32[i] - != in2_src->sin6_addr.s6_addr32[i])) - break; - - if (i < 4) { - bit1 = fls (ntohl (in1_dst->sin6_addr.s6_addr32[i] - ^ in1_src->sin6_addr.s6_addr32[i])); - bit2 = fls (ntohl (in2_dst->sin6_addr.s6_addr32[i] - ^ in2_src->sin6_addr.s6_addr32[i])); + uint32_t mask1, mask2; + if (i * 32 >= a1->prefixlen) + mask1 = 0; + else if ((i + 1) * 32 > a1->prefixlen) + mask1 = 0xffffffffu << (32 - (a1->prefixlen & 31)); + else + mask1 = 0xffffffffu; + if (i * 32 >= a2->prefixlen) + mask2 = 0; + else if ((i + 1) * 32 > a2->prefixlen) + mask2 = 0xffffffffu << (32 - (a2->prefixlen & 31)); + else + mask2 = 0xffffffffu; + if (((in1_dst->sin6_addr.s6_addr32[i] + ^ in1_src->sin6_addr.s6_addr32[i]) & htonl (mask1)) != 0 + || ((in2_dst->sin6_addr.s6_addr32[i] + ^ in2_src->sin6_addr.s6_addr32[i]) & htonl (mask2)) != 0) + { + bit1 = fls (ntohl (in1_dst->sin6_addr.s6_addr32[i] + ^ in1_src->sin6_addr.s6_addr32[i]) + & mask1); + bit2 = fls (ntohl (in2_dst->sin6_addr.s6_addr32[i] + ^ in2_src->sin6_addr.s6_addr32[i]) + & mask2); + break; + } } } @@ -1719,7 +1748,7 @@ in6aicmp (const void *p1, const void *p2) } -/* Name of the config file for RFC 3484 sorting (for now). */ +/* Name of the config file for RFC 6724 sorting (for now). */ #define GAICONF_FNAME "/etc/gai.conf" @@ -2405,7 +2434,7 @@ getaddrinfo (const char *name, const char *service, __libc_once_define (static, once); __typeof (once) old_once = once; __libc_once (once, gaiconf_init); - /* Sort results according to RFC 3484. */ + /* Sort results according to RFC 6724. */ struct sort_result *results; size_t *order; struct addrinfo *q; @@ -2577,11 +2606,11 @@ getaddrinfo (const char *name, const char *service, __libc_lock_lock (lock); if (__libc_once_get (old_once) && gaiconf_reload_flag) gaiconf_reload (); - __qsort_r (order, nresults, sizeof (order[0]), rfc3484_sort, &src); + __qsort_r (order, nresults, sizeof (order[0]), rfc6724_sort, &src); __libc_lock_unlock (lock); } else - __qsort_r (order, nresults, sizeof (order[0]), rfc3484_sort, &src); + __qsort_r (order, nresults, sizeof (order[0]), rfc6724_sort, &src); /* Queue the results up as they come out of sorting. */ q = p = results[order[0]].dest_addr; diff --git a/nss/tst-rfc3484-2.c b/nss/tst-rfc6724-2.c similarity index 95% rename from nss/tst-rfc3484-2.c rename to nss/tst-rfc6724-2.c index a5f8f82c04..f6442ca0ed 100644 --- a/nss/tst-rfc3484-2.c +++ b/nss/tst-rfc6724-2.c @@ -62,7 +62,7 @@ _res_hconf_init (void) nss_action_list __nss_hosts_database attribute_hidden; /* This is the beginning of the real test code. The above defines - (among other things) the function rfc3484_sort. */ + (among other things) the function rfc6724_sort. */ #if __BYTE_ORDER == __BIG_ENDIAN @@ -144,7 +144,7 @@ do_test (void) struct sort_result_combo combo = { .results = results, .nresults = 2 }; - qsort_r (order, 2, sizeof (order[0]), rfc3484_sort, &combo); + qsort_r (order, 2, sizeof (order[0]), rfc6724_sort, &combo); int result = 0; if (results[order[0]].dest_addr->ai_family == AF_INET6) @@ -174,7 +174,7 @@ do_test (void) order[0] = 0; - qsort_r (order, 2, sizeof (order[0]), rfc3484_sort, &combo); + qsort_r (order, 2, sizeof (order[0]), rfc6724_sort, &combo); if (results[order[0]].dest_addr->ai_family == AF_INET6) { diff --git a/nss/tst-rfc3484-3.c b/nss/tst-rfc6724-3.c similarity index 96% rename from nss/tst-rfc3484-3.c rename to nss/tst-rfc6724-3.c index edf0b7db2e..56223680bd 100644 --- a/nss/tst-rfc3484-3.c +++ b/nss/tst-rfc6724-3.c @@ -62,7 +62,7 @@ _res_hconf_init (void) nss_action_list __nss_hosts_database attribute_hidden; /* This is the beginning of the real test code. The above defines - (among other things) the function rfc3484_sort. */ + (among other things) the function rfc6724_sort. */ #if __BYTE_ORDER == __BIG_ENDIAN @@ -141,7 +141,7 @@ do_test (void) } struct sort_result_combo combo = { .results = results, .nresults = naddrs }; - qsort_r (order, naddrs, sizeof (order[0]), rfc3484_sort, &combo); + qsort_r (order, naddrs, sizeof (order[0]), rfc6724_sort, &combo); int result = 0; for (int i = 0; i < naddrs; ++i) diff --git a/nss/tst-rfc3484.c b/nss/tst-rfc6724.c similarity index 95% rename from nss/tst-rfc3484.c rename to nss/tst-rfc6724.c index 5b4a0c5b82..7063ae4635 100644 --- a/nss/tst-rfc3484.c +++ b/nss/tst-rfc6724.c @@ -62,7 +62,7 @@ _res_hconf_init (void) nss_action_list __nss_hosts_database attribute_hidden; /* This is the beginning of the real test code. The above defines - (among other things) the function rfc3484_sort. */ + (among other things) the function rfc6724_sort. */ #if __BYTE_ORDER == __BIG_ENDIAN @@ -91,7 +91,7 @@ static size_t order[naddrs]; static int expected[naddrs] = { - 9, 4, 3, 6, 5, 7, 8, 2, 0, 1 + 2, 3, 4, 5, 6, 7, 8, 9, 0, 1 }; @@ -133,7 +133,7 @@ do_test (void) } struct sort_result_combo combo = { .results = results, .nresults = naddrs }; - qsort_r (order, naddrs, sizeof (order[0]), rfc3484_sort, &combo); + qsort_r (order, naddrs, sizeof (order[0]), rfc6724_sort, &combo); int result = 0; for (int i = 0; i < naddrs; ++i) diff --git a/posix/gai.conf b/posix/gai.conf index 4616ed005b..de76e2c26f 100644 --- a/posix/gai.conf +++ b/posix/gai.conf @@ -1,7 +1,7 @@ # Configuration for getaddrinfo(3). # # So far only configuration for the destination address sorting is needed. -# RFC 3484 governs the sorting. But the RFC also says that system +# RFC 6724 governs the sorting. But the RFC also says that system # administrators should be able to overwrite the defaults. This can be # achieved here. # @@ -16,40 +16,34 @@ # used. There are possible runtime problems. The default is no. # # label -# Add another rule to the RFC 3484 label table. See section 2.1 in -# RFC 3484. The default is: +# Add another rule to the RFC 6724 label table. See section 2.1 in +# RFC 6724. The default is: # #label ::1/128 0 #label ::/0 1 #label 2002::/16 2 #label ::/96 3 #label ::ffff:0:0/96 4 -#label fec0::/10 5 -#label fc00::/7 6 -#label 2001:0::/32 7 -# -# This default differs from the tables given in RFC 3484 by handling -# (now obsolete) site-local IPv6 addresses and Unique Local Addresses. -# The reason for this difference is that these addresses are never -# NATed while IPv4 site-local addresses most probably are. Given -# the precedence of IPv6 over IPv4 (see below) on machines having only -# site-local IPv4 and IPv6 addresses a lookup for a global address would -# see the IPv6 be preferred. The result is a long delay because the -# site-local IPv6 addresses cannot be used while the IPv4 address is -# (at least for the foreseeable future) NATed. We also treat Teredo -# tunnels special. +#label 2001::/32 5 +#label fec0::/10 11 +#label 3ffe::/16 12 +#label fc00::/7 13 # # precedence -# Add another rule to the RFC 3484 precedence table. See section 2.1 -# and 10.3 in RFC 3484. The default is: -# -#precedence ::1/128 50 -#precedence ::/0 40 -#precedence 2002::/16 30 -#precedence ::/96 20 -#precedence ::ffff:0:0/96 10 -# -# For sites which prefer IPv4 connections change the last line to +# Add another rule to the RFC 6724 precedence table. See section 2.1 +# and 10.3 in RFC 6724. The default is: +# +#precedence ::1/128 50 +#precedence ::/0 40 +#precedence ::ffff:0:0/96 35 +#precedence 2002::/16 30 +#precedence 2001::/32 5 +#precedence fc00::/7 3 +#precedence ::/96 1 +#precedence fec0::/10 1 +#precedence 3ffe::/16 1 +# +# For sites which prefer IPv4 connections change the coresponding line to # #precedence ::ffff:0:0/96 100