netdev - Re: [PATCH net-next] inetpeer: Add support for VRFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Aug 2015 15:41:36 -0700
From:	David Ahern <dsa@...ulusnetworks.com>
To:	David Miller <davem@...emloft.net>
CC:	tgraf@...g.ch, netdev@...r.kernel.org, shm@...ulusnetworks.com
Subject: Re: [PATCH net-next] inetpeer: Add support for VRFs

On 8/25/15 1:47 PM, David Miller wrote:
> From: David Ahern <dsa@...ulusnetworks.com>
> Date: Sun, 23 Aug 2015 20:01:34 -0600
>
>> On 8/23/15 6:15 PM, Thomas Graf wrote:
>>> On 08/23/15 at 08:26am, David Ahern wrote:
>>>> inetpeer caches based on address only, so duplicate IP addresses
>>>> within
>>>> a namespace return the same cached entry. Similar to IP fragments
>>>> handle
>>>> duplicate addresses across VRFs by adding the VRF master device index
>>>> to
>>>> the lookup.
>>>
>>> We have a lot of other places which use the address only. Are you
>>> going to add the VRF id to all these places as well?
>>>
>>
>> If appropriate, yes. I have fixed IP fragments and this patch fixes
>> inetpeer cache. In both cases (L3 artifacts) the vrf device index
>> provides the means to uniquely identify duplicate IP addresses within
>> a namespace. If you know of other code that might be impacted I will
>> investigate and fix as needed.
>
> Anyways, what this inetpeer patch is doing is the wrong abstraction.
>
> The key is really "daddr + netdev" so make a helper that works using
> those arguments.

That's what I have here:

struct inetpeer_addr {
         struct inetpeer_addr_base       addr;
         __u16                           family;
#if IS_ENABLED(CONFIG_NET_VRF)
         int vif;
#endif
};

the addr_compare then checks the vif (VRF device index) after the N-word 
address compare.

>
> Then it is clear as we propagate this around that addresses need to
> be coupled with the device in question in order to be keyed properly.
>

Meaning rename struct inetpeer_addr to struct inetpeer_key and 
addr_compare to entry_compare or key_compare? Everything else still 
treats the address + VRF device as the key.

David
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html