netdev - Re: [PATCH] vxlan nits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Oct 2012 13:28:15 -0700
From:	Stephen Hemminger <shemminger@...tta.com>
To:	David L Stevens <dlstevens@...ibm.com>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] vxlan nits

On Fri, 19 Oct 2012 07:46:48 -0400
David L Stevens <dlstevens@...ibm.com> wrote:

> 
> This patch fixes a couple problems with vxlan.
> 
> 1) Improper check of NUD_PERMANENT makes permanent forwarding table
> 	entries timeout too.
> 
> 2) Check for "0.0.0.0" as gaddr and allow to mean "no group". The
> 	iproute2 patch sends gaddr even if not specified, which
> 	fails the IN_MULTICAST() test. This patch allows static-only
> 	forwarding and dropping everything else.
> 
> Signed-Off-By: David L Stevens <dlstevens@...ibm.com>
> 
> diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
> index 607976c..3fac9f3 100644
> --- a/drivers/net/vxlan.c
> +++ b/drivers/net/vxlan.c
> @@ -816,7 +816,7 @@ static void vxlan_cleanup(unsigned long arg)
>  				= container_of(p, struct vxlan_fdb, hlist);
>  			unsigned long timeout;
>  
> -			if (f->state == NUD_PERMANENT)
> +			if (f->state & NUD_PERMANENT)
>  				continue;
>  
>  			timeout = f->used + vxlan->age_interval * HZ;
> @@ -1047,7 +1047,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[])
>  
>  	if (data[IFLA_VXLAN_GROUP]) {
>  		__be32 gaddr = nla_get_be32(data[IFLA_VXLAN_GROUP]);
> -		if (!IN_MULTICAST(ntohl(gaddr))) {
> +		if (gaddr && !IN_MULTICAST(ntohl(gaddr))) {
>  			pr_debug("group address is not IPv4 multicast\n");
>  			return -EADDRNOTAVAIL;
>  		}
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

The first is a bug, the second doesn't need to be fixed in the kernel.
I change iproute to not sent group address unless it is defined.

The plan is to add IPV6 support, in which case group address could
be IPV6.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html