netdev - Re: [PATCH net-next v2 1/1] net: Allow a rule to track originating protocol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <153c6a8f-e984-41d4-ee9a-db5f1b9ffd4b@gmail.com>
Date:   Thu, 22 Feb 2018 16:46:29 -0700
From:   David Ahern <dsahern@...il.com>
To:     Ido Schimmel <idosch@...sch.org>,
        Donald Sharp <sharpd@...ulusnetworks.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net-next v2 1/1] net: Allow a rule to track originating
 protocol

On 2/22/18 10:20 AM, David Ahern wrote:
>> This breaks my scripts:
>> # ip -4 rule show
>> 0:      from all lookup local
>> 32766:  from all lookup main
>> 32767:  from all lookup default
>>
>> # ip -4 rule del pref 0
>> RTNETLINK answers: No such file or directory
>>
>> Using iproute 4.15 in Fedora 27:
>> # ip -V
>> ip utility, iproute2-ss180129
>>
>> Problem is iproute sets protocol to RTPROT_BOOT while rules are
>> installed with RTPROT_KERNEL.
>>
>> Maybe add FRA_PROTOCOL?
>>
>> Thanks!
> 
> ugh. Another iproute2 bug that the kernel has to deal with. iproute2 has
> been using rtm for the ancillary header for rules when it should have
> been fib_rule_hdr. That bug allowed someone to set the protocol field to
> RTPROT_BOOT which was complete nonsense for rules until Donald's recent
> patch.
> 
> That means all FIB rules need to default to RTPROT_BOOT. I hate to
> inherit that for the l3mdev rule, but looking at the iproute2 code I
> don't see any options.
> 
> Donald: send a patch that changes the protocol for kernel installed
> rules to RTPROT_BOOT.
> 

After more thinking, Donald is going move the protocol to an
FRA_PROTOCOL attribute as you suggested. That avoids breaking legacy
iproute2 and allows us to keep a sane default protocol value.