netdev - Re: [PATCH next 3/3] net: Use l3_dev instead of skb->dev for L3 processing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 8 Mar 2016 10:46:47 +0100
From:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:	Cong Wang <xiyou.wangcong@...il.com>,
	Mahesh Bandewar <maheshb@...gle.com>
Cc:	Mahesh Bandewar <mahesh@...dewar.net>,
	David Miller <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	netdev <netdev@...r.kernel.org>, Tim Hockin <thockin@...gle.com>,
	Alex Pollitt <alex.pollitt@...aswitch.com>,
	Matthew Dupre <matthew.dupre@...aswitch.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH next 3/3] net: Use l3_dev instead of skb->dev for L3
 processing

+ Eric B.

Le 08/03/2016 06:37, Cong Wang a écrit :
> On Fri, Mar 4, 2016 at 2:12 PM, Mahesh Bandewar <maheshb@...gle.com> wrote:
>>
>> Unfortunately we don't have a way to switch to ns after L3 processing.
>
> I am totally aware of this, this is exactly why I said this might not be easy.
>
> The question is how hard it is to implement one? My gut feeling is we only
> need to change some data in skb, something similar to skb_scrub_packet().
> But I never even try.

Note that Eric Biederman has made "some" patches to be able to "control" the
netns on the egress side. The goal is to be able to have routes that leak to
another netns.
It seems that the same work should probably be done at the ingress side.

I agree with Cong that just changing skb->dev is not the right approach.