netdev - Re: Inter-VRF routing on a single machine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <570D26EC.2000802@cumulusnetworks.com>
Date:	Tue, 12 Apr 2016 10:48:44 -0600
From:	David Ahern <dsa@...ulusnetworks.com>
To:	Darwin Dingel <darwin.dingel@...il.com>, netdev@...r.kernel.org
Subject: Re: Inter-VRF routing on a single machine

On 4/12/16 4:09 AM, Darwin Dingel wrote:
> Hi All,
>
> Have anyone tried the following setup on a single machine with 2 TCP
> sockets on different VRF's and succeeded?
>
> - client_socket on VRF1
> - server_socket on VRF2
> - ip rules and iproutes for inter-VRF set up
> - client_socket sends TCP connect to server_socket. skb was sent using
> VRF1 interface
> - skb received in loopback interface

That is the key problem there.

> - TCP code got SYN but cannot route back to VRF1 to send ACK.
>
> I was wondering if this is a known limitation of VRF as of the moment,
> or could work with proper iprules/iproute.

In general local (within a single system) routing does not work with top 
of tree. e.g., within a VRF you can not connect sockets or ping a VRF 
local address. Inter-vrf connections within a system also do not work.

I have patches from our 4.1 kernel that I have rebased to top of tree. I 
hope to test and send those out in the next week or so. It addresses the 
first problem -- connections within a VRF. While it does not resolve 
your problem of connecting across VRFs within a system I think it is the 
foundation for how to fix it.