netdev - Re: [PATCH net-next] inetpeer: Add support for VRFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150825173742.GA3707@pox.localdomain>
Date:	Tue, 25 Aug 2015 19:37:42 +0200
From:	Thomas Graf <tgraf@...g.ch>
To:	David Ahern <dsa@...ulusnetworks.com>
Cc:	netdev@...r.kernel.org, shm@...ulusnetworks.com
Subject: Re: [PATCH net-next] inetpeer: Add support for VRFs

On 08/23/15 at 08:01pm, David Ahern wrote:
> On 8/23/15 6:15 PM, Thomas Graf wrote:
> >On 08/23/15 at 08:26am, David Ahern wrote:
> >>inetpeer caches based on address only, so duplicate IP addresses within
> >>a namespace return the same cached entry. Similar to IP fragments handle
> >>duplicate addresses across VRFs by adding the VRF master device index to
> >>the lookup.
> >
> >We have a lot of other places which use the address only. Are you
> >going to add the VRF id to all these places as well?
> >
> 
> If appropriate, yes. I have fixed IP fragments and this patch fixes inetpeer
> cache. In both cases (L3 artifacts) the vrf device index provides the means
> to uniquely identify duplicate IP addresses within a namespace. If you know
> of other code that might be impacted I will investigate and fix as needed.

OK, then the question is what do you consider appropriate? ;-) An obvious
example is netfilter conntrack but eventually any decision based on an
address would require the VRF id if you want to go all the way.

I see the advantages over netns based VRF right now due to the lightweight
nature but if this turns out to require a new field in practically every
address datastructure then that seems not what we want.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html