netdev - Re: [PATCH 1/4] veth: move loopback logic to common location

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1aaybc1s5.fsf@fess.ebiederm.org>
Date:	Tue, 24 Nov 2009 08:42:34 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Patrick McHardy <kaber@...sh.net>
Cc:	Arnd Bergmann <arnd@...db.de>,
	virtualization@...ts.linux-foundation.org,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Eric Dumazet <eric.dumazet@...il.com>,
	Anna Fischer <anna.fischer@...com>, netdev@...r.kernel.org,
	bridge@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
	Mark Smith <lk-netdev@...netdev.nosense.org>,
	Gerhard Stenzel <gerhard.stenzel@...ibm.com>,
	Jens Osterkamp <jens@...ux.vnet.ibm.com>,
	Patrick Mullaney <pmullaney@...ell.com>,
	Stephen Hemminger <shemminger@...tta.com>,
	Edge Virtual Bridging <evb@...oogroups.com>,
	David Miller <davem@...emloft.net>
Subject: Re: [PATCH 1/4] veth: move loopback logic to common location

Patrick McHardy <kaber@...sh.net> writes:

>>>> I did all my testing with macvlan interfaces in separate namespaces
>>>> communicating with each other, so I'd assume that we should always
>>>> clear skb->mark and skb->dst in this function.
>>> Good point, in that case we probably should clear it as well. But
>>> in the non-namespace case the TC classification currently works and
>>> this is consistent with any other virtual device driver, so it
>>> should continue to work.
>> 
>> Do you think we should be able to use TC to direct traffic between
>> macvlans on the same underlying device in bridge mode? It does sound
>> useful, but I'm not sure how to implement that or if you'd expect
>> it to work with the current code. If we support that, it should probably
>> also work with namespaces, by consuming the mark in the macvlan
>> and veth drivers.
>
> I don't think its necessary, we bypass outgoing queuing anyways.
> But if you'd want to add it, just keeping the skb->mark clearing
> in veth should work from what I can tell.

veth doesn't have an outgoing queue.  The reason we clear skb->mark
in veth is because when reentering the networking stack the packet
needs to be reclassified.  At the point of loopback we are talking
a packet that has at least logically gone out of the machine on a
wire and come back into the machine on another physical interface.

So it seems to me we should have consistent handling for macvlans,
veth, for the cases where we are looping packets back around.  In
practice I expect all of those cases are going to be cross namespace
as otherwise we would have intercepted the packet before going
out a physical interface.

Eric




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html