netdev - Re: [PATCH 0/4] Prevent UDP tunnels from operating on garbage socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5523936A.9010609@baanhofman.nl>
Date:	Tue, 07 Apr 2015 10:20:58 +0200
From:	Wilco Baan Hofman <wilco@...nhofman.nl>
To:	Eric Dumazet <eric.dumazet@...il.com>,
	Tom Herbert <tom@...bertland.com>
CC:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org, pablo@...filter.org,
	hannes@...essinduktion.org,
	Jiří Pírko <jiri@...nulli.us>
Subject: Re: [PATCH 0/4] Prevent UDP tunnels from operating on garbage socket

On 07/04/15 07:03, Eric Dumazet wrote:
> On Mon, 2015-04-06 at 21:45 -0700, Tom Herbert wrote:
>> On Mon, Apr 6, 2015 at 8:51 PM, David Miller <davem@...emloft.net> wrote:
>>> I don't see what is convoluted about using the correct socket for
>>> sending L3 protocol frames.  That's in fact how it's _supposed_ to
>>> work.  And consistently having a proper matching socket available
>>> makes it so that, long-term, we'll never have to deal with this issue
>>> ever again.
>> I guess this is where I'm confused. We can send just about anything
>> over GRE also, but have never needed a transmit socket for that. Is
>> UDP encapsulation so different, or is GRE equally broken also? Also,
>> will we need to add the socket to FOU and GUE then?
> GRE encap is very low level (not L3), and no socket simply sends GRE
> packets as is.
FWIW, GRE encap is also broken for IPv6, it's layer 2, but only 8 bytes
can be used of the IPv6 address, because it uses sll_addr.

-- Wilco


Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)