netdev - Re: Issue with GRE tunnel, created with "local any" on kernel 3.14

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 31 Jul 2014 10:29:00 +0400
From:	Sergey Popov <pinkbyte@...too.org>
To:	Dmitry Popov <ixaphire@...tor.net>
CC:	Tom Herbert <therbert@...gle.com>, netdev@...r.kernel.org
Subject: Re: Issue with GRE tunnel, created with "local any" on kernel 3.14

18.07.2014 22:32, Dmitry Popov пишет:
> On Fri, 18 Jul 2014 17:01:23 +0400
> Sergey Popov <pinkbyte@...too.org> wrote:
> 
>> Hi. I have updated kernel on one of my servers to 3.14 and hit strange
>> issue:
> 
>> serv1(172.30.0.100) <-> serv2(172.30.0.251)
> 
>> Gre tunnel(serv1):
>> ip tunnel add tun_test mode gre remote 172.30.0.251 local any ttl 225
>> ifconfig tun_test 192.168.0.1/30
>>
>> Gre tunnel(serv2):
>> ip tunnel add tun_test mode gre remote 172.30.0.100 local any ttl 225
>> ifconfig tun_test 192.168.0.2/30
> 
>> 16:49:39.340971 IP 0.0.0.0 > 172.30.0.100: GREv0, length 88: IP
>> 192.168.0.2 > 192.168.0.1: ICMP echo request, id 5259, seq 7, length 64
> 
> Hi!
> 
> It seems we have this issue since 7d442fab0 (ipv4: Cache dst in tunnels).
> It is in ip_tunnel_xmit: fl4 is initialized with saddr = 0 in
> init_tunnel_flow(&fl4, protocol, dst, ...), net/ipv4/ip_tunnel.c:610,
> and isn't changed until iptunnel_xmit(skb->sk, ...), line 677, because 
> connected = true and rt is almost always cached.
> 
> I have no patch to fix this issue, but as a workaround, you can use 
> ip tunnel change tun_test tos inherit.

Thanks, your workaround works as expected if tos value defined
explicitly. Though, I do not understand why: iproute2 documentation says
that default tos value in 'ip tunnel' command is already 'inherit'.

-- 
Best regards, Sergey Popov
Gentoo developer
Gentoo Desktop Effects project lead
Gentoo Qt project lead
Gentoo Proxy maintainers project lead


Download attachment "signature.asc" of type "application/pgp-signature" (539 bytes)