netdev - Re: [PATCH net-next v2] net: Add fib rules at vrf device create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20151208.214411.2137019448940208712.davem@davemloft.net>
Date:	Tue, 08 Dec 2015 21:44:11 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	dsa@...ulusnetworks.com
Cc:	netdev@...r.kernel.org, shm@...ulusnetworks.com
Subject: Re: [PATCH net-next v2] net: Add fib rules at vrf device create

From: David Ahern <dsa@...ulusnetworks.com>
Date: Tue,  8 Dec 2015 12:48:05 -0800

> VRFs require ip rules for route lookups to work properly. Currently
> creating a VRF means instantiating a device and then adding the 4 ip
> and ip6 rules:
> 
>     ip link add vrf-${VRF} type vrf table ${TBID}
>     ip ru add oif vrf-${VRF} table ${TBID}
>     ip ru add iif vrf-${VRF} table ${TBID}
>     ip -6 ru add oif vrf-${VRF} table $TBID
>     ip -6 ru add iif vrf-${VRF} table $TBID
> 
> Since the table is required when the vrf device is created the rules can
> be inserted automatically lightening the overhead and improving the
> user experience (only the ip link add is needed).
> 
> Signed-off-by: David Ahern <dsa@...ulusnetworks.com>
> ---
> v2
> - addressed comments from Nik

Unfortunately it's too late for this, you should have considered this
issue fully when VRF first went into an upstream release.

If I add your change, the user experience is _worse_.

Users on older kernels have to use the full sequence, then if they
upgrade their kernels to one with this patch then the 'ru add' et
al. commands will fail.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html