netdev - Re: [PATCH net 0/2] lwtunnel: make it really work, for IPv4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Sep 2015 07:17:53 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Thomas Graf <tgraf@...g.ch>
Cc:	Jiri Benc <jbenc@...hat.com>, netdev@...r.kernel.org,
	Roopa Prabhu <roopa@...ulusnetworks.com>
Subject: Re: [PATCH net 0/2] lwtunnel: make it really work, for IPv4

Thomas Graf <tgraf@...g.ch> writes:

> On 09/22/15 at 11:39pm, Eric W. Biederman wrote:
>> What distinguishes a skb received from a tunnel as opposed to a skb
>> received on from a network device is that a skb recevied on a tunnel
>> has a socket.
>> 
>> I could be easily missing something but couldn't you look at skb->sk
>> on the input path and if a socket is present use the socket to compute
>> the outgoing route?
>> 
>> I expect it would just need to be something like:
>> dst = sk_dst_check(sk, 0);
>
> If you are talking about the UDP socket then that socket would cache
> the underlay route corresponding to the outer header. Jiri is looking
> for the outer header route to derive tunnel parameters from.

Assuming the transport is UDP then it would be a UDP socket.  That
socket will have all of the information needed to construct the outer
header as the receive path of that socket removes the outer header.

I admit you can't use the cached dst.  It is the wrong on that socket.

My point is that if we have the UDP socket and we have the sk we have
all of the information we need to compute the reverse dst.

Having looked a little closer this seems to fall apart in practice as
the tunnel receive path appears to never call skb_set_owner or otherwise
set skb->sk.

Still I am not certain that limitation is fatal.  Looking at the
incoming socket still feels like the right thing to do in this
situation.

Eric

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html