netdev - Re: [PATCH 3/3] vxlan: virtual extensible lan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Oct 2012 21:02:20 -0700
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Jesse Gross <jesse@...ira.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH 3/3] vxlan: virtual extensible lan

On Wed, 3 Oct 2012 18:54:46 -0700
Jesse Gross <jesse@...ira.com> wrote:

> On Mon, Oct 1, 2012 at 3:32 PM, Stephen Hemminger <shemminger@...tta.com> wrote:
> > --- /dev/null   1970-01-01 00:00:00.000000000 +0000
> > +++ b/drivers/net/vxlan.c       2012-10-01 15:08:38.024499080 -0700
> > +/* Transmit local packets over Vxlan
> > + *
> > + * Outer IP header inherits ECN and DF from inner header.
> > + * Outer UDP destination is the VXLAN assigned port.
> > + *           source port is based on hash of flow if available
> > + *                       otherwise use a random value
> > + */
> > +static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
> [...]
> > +       hash = skb_get_rxhash(skb);
> [...]
> > +       uh->dest = htons(vxlan_port);
> > +       uh->source = hash ? :random32();
> 
> I think this may lead to packet reordering in some cases.  If the
> protocol is unknown then it may still represent part of a flow and
> random source ports could lead to taking different paths.
> 
> Also, does it make sense to restrict the range of ports to, say, the
> upper half of the range?

Since port is always a pair, there is no need to restrict range, unless
there was a broken firewall in the way. One bug there is that random32()
can return 0 which is not a valid port number.  A better fallback
would be a hash of the MAC header.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html