netdev - Re: [PATCH 1/1] reset nf before xmit vxlan encapsulated packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20130305.235633.2031561829817668254.davem@davemloft.net>
Date:	Tue, 05 Mar 2013 23:56:33 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	zealot0630@...il.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH 1/1] reset nf before xmit vxlan encapsulated packet

From: Zang MingJie <zealot0630@...il.com>
Date: Tue,  5 Mar 2013 00:07:34 +0800

> 
> We should reset nf settings bond to the skb as ipip/ipgre do.
> 
> If not, the conntrack/nat info bond to the origin packet may continually
> redirect the packet to vxlan interface causing a routing loop.
> 
> this is the scenario:
> 
>      VETP     VXLAN Gateway
>     /----\  /---------------\
>     |    |  |               |
>     |  vx+--+vx --NAT-> eth0+--> Internet
>     |    |  |               |
>     \----/  \---------------/
> 
> when there are any packet coming from internet to the vetp, there will be lots
> of garbage packets coming out the gateway's vxlan interface, but none actually
> sent to the physical interface, because they are redirected back to the vxlan
> interface in the postrouting chain of NAT rule, and dmesg complains:
> 
>     Mar  1 21:52:53 debian kernel: [ 8802.997699] Dead loop on virtual device vxlan0, fix it urgently!
>     Mar  1 21:52:54 debian kernel: [ 8804.004907] Dead loop on virtual device vxlan0, fix it urgently!
>     Mar  1 21:52:55 debian kernel: [ 8805.012189] Dead loop on virtual device vxlan0, fix it urgently!
>     Mar  1 21:52:56 debian kernel: [ 8806.020593] Dead loop on virtual device vxlan0, fix it urgently!
> 
> the patch should fix the problem
> 
> Signed-off-by: Zang MingJie <zealot0630@...il.com>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html