netdev - Re: OVS VXLAN decap rule has full match on TTL for the outer headers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 10 Dec 2015 23:43:09 +0200
From:	Or Gerlitz <gerlitz.or@...il.com>
To:	Joe Stringer <joe@....org>
Cc:	Jarno Rajahalme <jarno@....org>, Jesse Gross <jesse@...nel.org>,
	Or Gerlitz <ogerlitz@...lanox.com>,
	Haggai Eran <haggaie@...lanox.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Ilya Lesokhin <ilyal@...lanox.com>,
	Rony Efraim <ronye@...lanox.com>,
	Hadar Hen Zion <hadarh@...lanox.com>,
	Tal Anker <Ankertal@...lanox.com>
Subject: Re: OVS VXLAN decap rule has full match on TTL for the outer headers?

On Thu, Dec 10, 2015 at 11:23 PM, Joe Stringer <joe@....org> wrote:
> On 10 December 2015 at 13:06, Or Gerlitz <gerlitz.or@...il.com> wrote:
>> On Wed, Dec 9, 2015 at 2:22 AM, Joe Stringer <joe@....org> wrote:

>>>>> As far as the mask, I briefly discussed this with Jarno and it seems
>>>>> like it could be something as simple as zeroing the ip_ttl mask in
>>>>> tnl_wc_init().

>>>> to make sure I follow, will that have the consequence that we (user +
>>>> kernel) will practically not be testing the ttl for these flows?

>>> Yes, it would cause userspace to 'wildcard' the field so the kernel
>>> flows that are installed will ignore it during lookup.

>> Cool, any chance this is gonna fit into your schedule to meet 4.4? if
>> not, for 4.5?
>> Also, can the patch be made simple/small enough to go into -stable as well?

> It's a userspace change.


mmm, in a downstream post of this thread [1] Haggai pointed to you
that there's code in the OVS kernel path that that rejects new tunnel
flows if they don't have the TTL mask set, so he's wrong? where?

Or.

[1] http://marc.info/?l=linux-netdev&m=144880328121156&w=2
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html