netdev - Re: [PATCH] ipv6_tunnel: Allow receiving packets on the fallback tunnel if they pass sanity checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20120629.005258.2188206674865275736.davem@davemloft.net>
Date:	Fri, 29 Jun 2012 00:52:58 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	phil@...m.com
Cc:	netdev@...r.kernel.org, phild@...com, ville.nuorvala@...il.com
Subject: Re: [PATCH] ipv6_tunnel: Allow receiving packets on the fallback
 tunnel if they pass sanity checks

From: Phil Dibowitz <phil@...m.com>
Date: Thu, 28 Jun 2012 21:15:52 -0700

> From: Ville Nuorvala <ville.nuorvala@...il.com>
> 
> At Facebook, we do Layer-3 DSR via IP-in-IP tunneling. Our load balancers wrap
> an extra IP header on incoming packets so they can be routed to the backend.
> In the v4 tunnel driver, when these packets fall on the default tunl0 device,
> the behavior is to decapsulate them and drop them back on the stack. So our
> setup is that tunl0 has the VIP and eth0 has (obviously) the backend's real
> address.
> 
> In IPv6 we do the same thing, but the v6 tunnel driver didn't have this same
> behavior - if you didn't have an explicit tunnel setup, it would drop the
> packet.
> 
> This patch brings that v4 feature to the v6 driver.
> 
> The same IPv6 address checks are performed as with any normal tunnel,
> but as the fallback tunnel endpoint addresses are unspecified, the checks
> must be performed on a per-packet basis, rather than at tunnel
> configuration time.
> 
> [Patch description modified by phil@...m.com]
> 
> Signed-off-by: Ville Nuorvala <ville.nuorvala@...il.com>
> Tested-by: Phil Dibowitz <phil@...m.com>

Applied to net-next
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html