netdev - Re: iproute2 (2012-11-08) and tunnel mode vti problems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20121108163310.48c67965@s6510.linuxnetplumber.net>
Date:	Thu, 8 Nov 2012 16:33:10 +0100
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Ruben Herold <ruben@...ttmann.net>
Cc:	Saurabh Mohan <saurabh.mohan@...tta.com>, netdev@...r.kernel.org
Subject: Re: iproute2 (2012-11-08) and tunnel mode vti problems

> I have here some problems with the newest iproute2 taken from git today.
> I will play around with the new vti mode. 
> 
> First problem ist after loading the ip_vti module I got an ioctl error
> on ip tunnel show:
> 
> ---------------------------------------------------------------------
> root@...ec0:[~] > ip -V
> ip utility, iproute2-ss121108
> root@...ec0:[~] > uname -a
> Linux ipsec0 3.6.6 #1 SMP Tue Nov 6 16:21:05 CET 2012 i686 GNU/Linux
> root@...ec0:[~] > modprobe ip_vti 
> root@...ec0:[~] > ip tunnel show
> ip_vti0: ioctl 89f4 failed: Invalid argument
> ip_vti0: ip/ip  remote any  local any  ttl inherit  nopmtudisc key 0
> root@...ec0:[~] > 
> --------------------------------------------------------------------

Found the cause of the problem. It is a kernel issue.

The kernel implementation of VTI uses same flag bit as SIT tunnel,
and 'ip tunnel show' is using SIT flag to decide whether to look
up sit tunnel parameters, which fails on VTI.

It is a bug introduced in ioctl definition for VTI. Not sure
what the best way to fix it is? Add more kludge code in ip command,
or change definition of flag bit, and risk userspace ABI incompatibility.

Also, there is the issue that i_flags is a confusing mix of
network byte order bits or'd with host byte order bits. The initial
definition of SIT was broken long, long ago.

Copying netdev list.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html