Scope ids get embedded into IPv6 link-local addresses on OpenBSD, NetBSD and macOS

[evverx]

I'm not sure whether scapy parses routing messages incorrectly or whether they are borked somehow but until then here is the output I got in https://github.com/evverx/avahi/actions/runs/28585921673/job/84757378878?pr=3 where the following commands were run on OpenBSD:

ifconfig
git clone https://github.com/secdev/scapy
cd scapy
python3 -c 'from scapy.all import *; print(conf.ifaces); print(conf.route); print(conf.route6)'

ifconfig shows for example fe80::5054:ff:fe12:3456 while scapy ends up with fe80:1::5054:ff:fe12:3456.

+ ifconfig
lo0: flags=2008049<UP,LOOPBACK,RUNNING,MULTICAST,LRO> mtu 32768
	index 3 priority 0 llprio 3
	groups: lo
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
	inet 127.0.0.1 netmask 0xff000000
em0: flags=a48843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF6TEMP,AUTOCONF6,AUTOCONF4> mtu 1500
	lladdr 52:54:00:12:34:56
	index 1 priority 0 llprio 3
	groups: egress
	media: Ethernet autoselect (1000baseT full-duplex)
	status: active
	inet6 fe80::5054:ff:fe12:3456%em0 prefixlen 64 scopeid 0x1
	inet 10.0.2.15 netmask 0xffffff00 broadcast 10.0.2.255
	inet6 fec0::dd27:a29:7b7b:4029 prefixlen 64 autoconf pltime 14328 vltime 86328
	inet6 fec0::5a22:4d10:1d14:7b95 prefixlen 64 autoconf temporary pltime 14328 vltime 86328
enc0: flags=0<>
	index 2 priority 0 llprio 3
	groups: enc
	status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33136
	index 4 priority 0 llprio 3
	groups: pflog
Cloning into 'scapy'...
+ cd scapy
+ py=python3
+ [[ openbsd == netbsd ]]
+ python3 -c 'from scapy.all import *; print(conf.ifaces); print(conf.route); print(conf.route6)'
Source  Index  Name    MAC                IPv4       IPv6                     
BPF     1      em0     52:54:00:12:34:56  10.0.2.15  fe80:1::5054:ff:fe12:3456
                                                     fec0::dd27:a29:7b7b:4029 
                                                     fec0::5a22:4d10:1d14:7b95
BPF     3      lo0     00:00:00:00:00:00  127.0.0.1  ::1                      
                                                     fe80:3::1                
BPF     4      pflog0  00:00:00:00:00:00                                      
Network     Netmask          Gateway    Iface  Output IP  Metric
0.0.0.0     0.0.0.0          10.0.2.2   em0    10.0.2.15  1     
10.0.2.0    255.255.255.0    10.0.2.15  em0    10.0.2.15  1     
10.0.2.15   255.255.255.255  0.0.0.0    em0    10.0.2.15  1     
10.0.2.2    255.255.255.255  0.0.0.0    em0    10.0.2.15  1     
10.0.2.255  255.255.255.255  10.0.2.15  em0    10.0.2.15  1     
10.0.2.3    255.255.255.255  0.0.0.0    em0    10.0.2.15  1     
127.0.0.0   255.0.0.0        127.0.0.1  lo0    127.0.0.1  1     
127.0.0.1   255.255.255.255  127.0.0.1  lo0    127.0.0.1  1     
224.0.0.0   240.0.0.0        127.0.0.1  lo0    127.0.0.1  1     
Destination           Next Hop              Iface  Src candidates        Metric
fe80:1::2/128         ::                    em0    fe80:1::5054:ff:fe1_  1     
fe80:1::5054:ff:fe1_  ::                    em0    fe80:1::5054:ff:fe1_  1     
fec0::5a22:4d10:1d1_  ::                    em0    fec0::5a22:4d10:1d1_  1     
fec0::dd27:a29:7b7b_  ::                    em0    fec0::dd27:a29:7b7b_  1     
::/96                 ::1                   lo0    ::1                   1     
::1/128               ::1                   lo0    ::1                   1     
::ffff:0.0.0.0/96     ::1                   lo0    ::1                   1     
2002::/24             ::1                   lo0    ::1                   1     
2002:7f00::/24        ::1                   lo0    ::1                   1     
2002:e000::/20        ::1                   lo0    ::1                   1     
2002:ff00::/24        ::1                   lo0    ::1                   1     
fe80::/10             ::1                   lo0    ::1                   1     
fec0::/10             ::1                   lo0    ::1                   1     
ff01::/16             ::1                   lo0    ::1                   1     
ff02::/16             ::1                   lo0    ::1                   1     
::/0                  fe80:1::2             em0    fe80:1::5054:ff:fe1_  1     
fe80:1::/64           fe80:1::5054:ff:fe1_  em0    fe80:1::5054:ff:fe1_  1     
ff01:1::/32           fe80:1::5054:ff:fe1_  em0    fe80:1::5054:ff:fe1_  1     
ff02:1::/32           fe80:1::5054:ff:fe1_  em0    fe80:1::5054:ff:fe1_  1     
fe80:3::1/128         fe80:3::1             lo0    fe80:3::1             1     
ff01:3::/32           fe80:3::1             lo0    fe80:3::1             1     
ff02:3::/32           fe80:3::1             lo0    fe80:3::1             1     
fec0::/64             fec0::5a22:4d10:1d1_  em0    fec0::5a22:4d10:1d1_  1     
fec0::/64             fec0::dd27:a29:7b7b_  em0    fec0::dd27:a29:7b7b_  1     
+ exit 0

The images come from https://github.com/cross-platform-actions/action

[evverx]

According to https://man.openbsd.org/inet6.4

Scoped addresses are handled specially in the kernel. In kernel structures like routing tables or interface structures, scoped addresses have their interface index embedded into the address. Therefore the address on some kernel structures is not the same as that on the wire. The embedded index will be visible on PF_ROUTE sockets, kernel memory access via kvm(3), and some other occasions. HOWEVER, users should never use the embedded form.

avahi zeroes those bytes on receiving them: https://github.com/avahi/avahi/blob/81c3c27478de8bd275ebb499c832fcbb2e6f561c/avahi-core/iface-pfroute.c#L211-L216

#ifdef __KAME__
	  if (IN6_IS_ADDR_LINKLOCAL((struct in6_addr *)raddr.data.data))
	    {
	      ((struct in6_addr *)raddr.data.data)->s6_addr[2] = 0;
	      ((struct in6_addr *)raddr.data.data)->s6_addr[3] = 0;
	    }
#endif

[guedou]

Are you able to use `git bisect` to check if a commit introduced the issue ?

[evverx]

I think it was introduced in 528626a (where scapy switched to sysctl(CTL_NET))

[evverx]

I double-checked and with 528626a~1 (dcb0e0c) the scope ids are gone

+ python3 -c 'from scapy.all import *; print(conf.ifaces); print(conf.route); print(conf.route6)'
Source  Index  Name  MAC                IPv4       IPv6                    
BPF     1      em0   52:54:00:12:34:56  10.0.2.15  fe80::5054:ff:fe12:3456 
                                                   fec0::dd27:a29:7b7b:4029
                                                   fec0::457b:428c:629a:a32
BPF     3      lo0   00:00:00:00:00:00  127.0.0.1  ::1                     
                                                   fe80::1                 
Network     Netmask          Gateway    Iface  Output IP  Metric
0.0.0.0     0.0.0.0          10.0.2.2   em0    10.0.2.15  1     
10.0.2.0    255.255.255.0    0.0.0.0    em0    10.0.2.15  1     
10.0.2.15   255.255.255.255  0.0.0.0    em0    10.0.2.15  1     
10.0.2.255  255.255.255.255  0.0.0.0    em0    10.0.2.15  1     
127.0.0.0   255.0.0.0        127.0.0.1  lo0    127.0.0.1  1     
127.0.0.1   255.255.255.255  0.0.0.0    lo0    127.0.0.1  1     
224.0.0.0   240.0.0.0        0.0.0.0    lo0    127.0.0.1  1     
Destination           Next Hop              Iface  Src candidates        Metric
::1/128               ::                    lo0    ::1                   1     
fe80::2/128           ::                    em0    fe80::5054:ff:fe12:_  1     
fe80::5054:ff:fe12:_  ::                    em0    fe80::5054:ff:fe12:_  1     
fe80::1/128           ::                    lo0    ::1                   1     
fec0::457b:428c:629_  ::                    em0    fec0::dd27:a29:7b7b_  1     
                                                   fec0::457b:428c:629_        
fec0::dd27:a29:7b7b_  ::                    em0    fec0::dd27:a29:7b7b_  1     
                                                   fec0::457b:428c:629_        
fe80::/64             fe80::5054:ff:fe12:_  em0    fe80::5054:ff:fe12:_  1     
fec0::/64             fec0::457b:428c:629_  em0    fec0::dd27:a29:7b7b_  1     
                                                   fec0::457b:428c:629_        
fec0::/64             fec0::dd27:a29:7b7b_  em0    fec0::dd27:a29:7b7b_  1     
                                                   fec0::457b:428c:629_        

[evverx]

I went with the following quick fix locally

diff --git a/scapy/arch/bpf/pfroute.py b/scapy/arch/bpf/pfroute.py
index e81c2b50..ea9a2fa2 100644
--- a/scapy/arch/bpf/pfroute.py
+++ b/scapy/arch/bpf/pfroute.py
@@ -417,6 +417,16 @@ class sockaddr(Packet):
         ),
     ]
 
+    def pre_dissect(self, s):
+        if s[1] != socket.AF_INET6:
+            return s
+
+        a, b = struct.unpack("BB", s[8:10])
+        if a == 0xfe and (b & 0xc0) == 0x80:
+            return s[:10] + b'\x00\x00' + s[12:]
+
+        return s
+
     def default_payload_class(self, payload: bytes) -> Type[Packet]:
         return conf.padding_layer

it needs better error handling, tests, post_build probably (to embed them again when necessary) but it kind of works on OpenBSD, NetBSD and macOS for now on the receiving side. The right fix isn't that straightforward.