netdev - Re: [PATCH net-next] net: Remove VRF change to udp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 31 Aug 2015 10:22:03 -0700
From:	Tom Herbert <tom@...bertland.com>
To:	David Ahern <dsa@...ulusnetworks.com>
Cc:	Linux Kernel Network Developers <netdev@...r.kernel.org>,
	Shrijeet Mukherjee <shm@...ulusnetworks.com>
Subject: Re: [PATCH net-next] net: Remove VRF change to udp_sendmsg

On Mon, Aug 31, 2015 at 10:05 AM, David Ahern <dsa@...ulusnetworks.com> wrote:
> On 8/31/15 11:02 AM, Tom Herbert wrote:
>>
>> On Mon, Aug 31, 2015 at 9:29 AM, David Ahern <dsa@...ulusnetworks.com>
>> wrote:
>>>
>>> Remove the VRF change in udp_sendmsg to set the source address. The VRF
>>> driver already has access to the packet on the TX path via the dst. It
>>> can be used to update the source address in the header.
>>>
>>
>> I don't understand this. The previous code was about selecting a
>> source address for packets being sourced ed on a socket, but this new
>> patch seems to essentially be doing SNAT in the VRF transmit path
>> which  seems like a fundamentally different behavior. Is this really
>> your intention?
>>
>
> The original code and this new code are only controlling FIB lookups which
> in turn set the source address. Functionally both versions do the same
> thing.
>
It's a major departure from current convention. The source address of
the packet should be set before doing ip_send_skb. In UDP unconnected
case ip_route_output_flow calls inet_select_addr. AKAIK there is no
provision for not setting the source address and relying on the output
device to do this in its transmit routine. I still think it would be
better to call into the VRF device from inet_select_addr using an ndo
function.

Tom

 > David
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html