ipv6: tie the dst cookie to the lookup that returned the dst

Hi,

This series implements a first part of the model proposed in [1] to address the late cookie sampling race: a dst can be stored together with a cookie read after a FIB change that its lookup did not see, and then passes dst_check until the next change.

The case that made me post it as a series is xfrm. Adding a policy restamps every fib6 node, so a socket whose lookup ran just before the insertion keeps its plain dst and leaks plaintext although the policy matches. I reproduced it for TCP connect and connected UDP, and the same window lets a more specific blackhole route be bypassed for routes using nexthop objects. The ovpn patch [2] hit the same pattern in dst_cache_set_ip6.

The conversion is initially limited to tcp_v6_connect, ip6_datagram_dst_update and ip6_sk_dst_lookup_flow. Other TCP TX cache paths, including established-socket route refills, header rebuilds and accepted-socket setup, still use late cookie sampling. This gives the lookup-cookie API a small set of users and concrete fixes to review. If the approach is accepted, I plan to follow up with a broader conversion across the networking core and drivers.

Compared to [1], the fallback cookie is 0 instead of the pre-lookup generation, so fib6_flush_trees is left alone, and nexthop-object dsts are checked in ip6_dst_check instead of passing the generation down to ip6_rt_pcpu_alloc. The other cache users (dst_cache, sctp, ipvs, flowtable, sk_rx_dst, the xfrm bundle cookies) are not converted and behave as before.

I tested it in a VM with lockdep, PROVE_RCU and DEBUG_ATOMIC_SLEEP, using a debug-only delay after the lookup to hit the window: no warnings, and the plaintext and blackhole bypass are gone in these test cases.

[1] https://lore.kernel.org/netdev/[email protected]/
[2] https://lore.kernel.org/netdev/[email protected]/

Thanks,

Ralf Lici
Mandelbit Srl

---
Changes since v1 https://lore.kernel.org/netdev/[email protected]/
- Fix kdoc return statements in patch 2/3. (NIPA)

Ralf Lici (3):
ipv6: stamp the default route node with a fresh serial on link failure
ipv6: add ip6_dst_lookup_flow_cookie
ipv6: use the lookup cookie when caching the dst in sockets

 include/net/ip6_route.h | 18 +++++++++----
 include/net/ipv6.h      | 13 ++++++++++
 net/ipv6/datagram.c     |  6 +++--
 net/ipv6/ip6_output.c   | 57 ++++++++++++++++++++++++++++++++++++++---
 net/ipv6/route.c        | 24 ++++++++---------
 net/ipv6/tcp_ipv6.c     |  5 ++--
 6 files changed, 98 insertions(+), 25 deletions(-)

base-commit: c4c470912125ec8a1a427a70f4085d8a731b00e4

2.56.0