linux-kernel - Re: [PATCH 1/4] veth: move loopback logic to common location

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Nov 2009 19:28:58 +0100
From:	Arnd Bergmann <arnd@...db.de>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Patrick McHardy <kaber@...sh.net>,
	virtualization@...ts.linux-foundation.org,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Eric Dumazet <eric.dumazet@...il.com>,
	Anna Fischer <anna.fischer@...com>, netdev@...r.kernel.org,
	bridge@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
	Mark Smith <lk-netdev@...netdev.nosense.org>,
	Gerhard Stenzel <gerhard.stenzel@...ibm.com>,
	Jens Osterkamp <jens@...ux.vnet.ibm.com>,
	Patrick Mullaney <pmullaney@...ell.com>,
	Stephen Hemminger <shemminger@...tta.com>,
	Edge Virtual Bridging <evb@...oogroups.com>,
	David Miller <davem@...emloft.net>
Subject: Re: [PATCH 1/4] veth: move loopback logic to common location

On Tuesday 24 November 2009, Eric W. Biederman wrote:
> I don't quite follow what you intend with dev_queue_xmit when the macvlan
> is in one namespace and the real physical device is in another.  Are
> you mentioning that the packet classifier runs in the namespace where
> the primary device lives with packets from a different namespace?

I treat internal and external delivery very differently, the three
cases are:

1. skb from real device to macvlan (macvlan_handle_frame): basically
unchanged from before, except avoiding duplicate broadcasts. All
skbs end up in netif_rx(vlan->dev) without clearing any data.
We catch the frame in netif_receive_skb before it interacts with the
namespace of the real device.

2. skb to external device (macvlan_start_xmit): if the destination
is external, we just end up in dev_queue_xmit, with skb->dev set to
the external device but no other changes. The data is already on the
way out at this stage, so the namespace should not matter any more.

3. internal delivery: an skb from one macvlan to another gets always
sent through dev_forward_skb, which is supposed to clear anything
that must not leave the namespace.

Does this make sense?

	Arnd <><
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/