netdev - Re: OVS VXLAN decap rule has full match on TTL for the outer headers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANr6G5xe7URQgr=C7gL=xoAaUf5rXPQByBZscmNSVHyv2=+wRg@mail.gmail.com>
Date:	Fri, 13 Nov 2015 22:45:15 -0800
From:	Joe Stringer <joestringer@...ira.com>
To:	Or Gerlitz <gerlitz.or@...il.com>
Cc:	Jesse Gross <jesse@...nel.org>, Or Gerlitz <ogerlitz@...lanox.com>,
	Jesse Gross <jesse@...ira.com>,
	Haggai Eran <haggaie@...lanox.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Ilya Lesokhin <ilyal@...lanox.com>,
	Rony Efraim <ronye@...lanox.com>,
	Hadar Hen Zion <hadarh@...lanox.com>
Subject: Re: OVS VXLAN decap rule has full match on TTL for the outer headers?

On 13 November 2015 at 06:46, Or Gerlitz <gerlitz.or@...il.com> wrote:
> On Fri, Nov 13, 2015 at 10:14 AM, Joe Stringer <joestringer@...ira.com> wrote:
>
>> I don't follow the logic. You observed one flow which matched on
>> TTL=64, therefore all vxlan packets terminated at OVS have TTL=64?
>
>> If OVS received packets with different TTLs, they would miss and
>> ovs-vswitchd would generate flows to match that traffic too.
>
> ok, that makes things a bit better, but (see next)
>
>> If that becomes an issue, presumably the wildcard generation can be improved.
>
> is there a deep reason for vlxan "learned flows" to actually match w
> or w.o wild cards on TTLs?? for non-tunneled flow I don't see  this
> happening.

No deep reason I'm aware of.

>> I agree that this UNSPEC issue on v2.3 could do with a bit of a closer
>> look. I'll see if I can find some time for it. Alternatively if you're
>> willing and have bandwith, I'd be curious if it's related to the
>> masked set field feature introduced in Linux-4.0.
>
> so what would you suggest here? run with 3.19 or earlier?

On second thought, I think if it were related to that then userspace
v2.4 would not exhibit the problem. I'd have to dig in to see why it
occurs.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html