netdev - Re: [PATCH net] net: Avoid receiving packets with an l3mdev on unbound UDP sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52c73e8e-56e8-efe4-49df-e189f35e3017@cumulusnetworks.com>
Date:   Thu, 26 Jan 2017 11:12:50 -0700
From:   David Ahern <dsa@...ulusnetworks.com>
To:     Robert Shearman <rshearma@...cade.com>, davem@...emloft.net
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net] net: Avoid receiving packets with an l3mdev on
 unbound UDP sockets

On 1/26/17 11:02 AM, Robert Shearman wrote:
> Packets arriving in a VRF currently are delivered to UDP sockets that
> aren't bound to any interface. TCP defaults to not delivering packets
> arriving in a VRF to unbound sockets. IP route lookup and socket
> transmit both assume that unbound means using the default table and
> UDP applications that haven't been changed to be aware of VRFs may not
> function correctly in this case since they may not be able to handle
> overlapping IP address ranges, or be able to send packets back to the
> original sender if required.
> 
> So add a sysctl, udp_l3mdev_accept, to control this behaviour with it
> being analgous to the existing tcp_l3mdev_accept, namely to allow a
> process to have a VRF-global listen socket. Have this default to off
> as this is the behaviour that users will expect, given that there is
> no explicit mechanism to set unmodified VRF-unaware application into a
> default VRF.
> 
> Signed-off-by: Robert Shearman <rshearma@...cade.com>
> ---
> I've targetted this for the net tree because I believe the expected
> behaviour is different enough from the current behaviour to be
> considered a bug. However, this should also apply to the net-next tree
> as-is if this not deemed a bug.
> 

I have almost this exact patch in my tree and I have it marked as not working so 1 or more test cases is failing.

So, really this is just a note that I need to test this and need some time to get to it.