netdev - Re: [PATCH] net: allow interface to be set into VRF if VLAN interface in same VRF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180301.212635.783607434433134528.davem@davemloft.net>
Date:   Thu, 01 Mar 2018 21:26:35 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     mmanning@...tta.mail-att.com
Cc:     netdev@...r.kernel.org, dsahern@...il.com
Subject: Re: [PATCH] net: allow interface to be set into VRF if VLAN
 interface in same VRF

From: Mike Manning <mmanning@...tta.mail-att.com>
Date: Mon, 26 Feb 2018 23:49:30 +0000

> Setting an interface into a VRF fails with 'RTNETLINK answers: File
> exists' if one of its VLAN interfaces is already in the same VRF.
> As the VRF is an upper device of the VLAN interface, it is also showing
> up as an upper device of the interface itself. The solution is to
> restrict this check to devices other than master. As only one master
> device can be linked to a device, the check in this case is that the
> upper device (VRF) being linked to is not the same as the master device
> instead of it not being any one of the upper devices.
> 
> The following example shows an interface ens12 (with a VLAN interface
> ens12.10) being set into VRF green, which behaves as expected:
> 
>   # ip link add link ens12 ens12.10 type vlan id 10
>   # ip link set dev ens12 master vrfgreen
>   # ip link show dev ens12
>     3: ens12: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel
>        master vrfgreen state UP mode DEFAULT group default qlen 1000
>        link/ether 52:54:00:4c:a0:45 brd ff:ff:ff:ff:ff:ff
> 
> But if the VLAN interface has previously been set into the same VRF,
> then setting the interface into the VRF fails:
> 
>   # ip link set dev ens12 nomaster
>   # ip link set dev ens12.10 master vrfgreen
>   # ip link show dev ens12.10
>     39: ens12.10@...12: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
>     qdisc noqueue master vrfgreen state UP mode DEFAULT group default
>     qlen 1000 link/ether 52:54:00:4c:a0:45 brd ff:ff:ff:ff:ff:ff
>   # ip link set dev ens12 master vrfgreen
>     RTNETLINK answers: File exists
> 
> The workaround is to move the VLAN interface back into the default VRF
> beforehand, but it has to be shut first so as to avoid the risk of
> traffic leaking from the VRF. This fix avoids needing this workaround.
> 
> Signed-off-by: Mike Manning <mmanning@....com>

Applied, thanks Mike.