netdev - Re: [PATCH net-next] net: do not create fallback tunnels for non-default namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Mar 2018 05:18:24 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Jiri Benc <jbenc@...hat.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [PATCH net-next] net: do not create fallback tunnels for
 non-default namespaces

On Fri, Mar 9, 2018 at 5:08 AM, Jiri Benc <jbenc@...hat.com> wrote:
> On Fri, 9 Mar 2018 04:53:07 -0800, Eric Dumazet wrote:
>> Unless you bring it up ;)
>
> Often, you need some options to be specified, thus you end up creating
> another interface anyway.
>
>> Compatibility problems,  mostly.
>> Some users might depend on existing behavior.
>
> How is this a compatibility problem, when the user has to opt in?
> Without the default value, the kernel behaves as before. I'm sorry,
> I don't see the problem, what am I missing?

How do you opt in exactly ?

Once it is too late and gre0 is already there ?

ip_gre can be statically built in vmlinux

Are you suggesting to add a module parameter ?

I wont do it but feel free to send a patch and wait for David flames :)

>
>> You and me would not care of breaking our setups, but maybe not
>> unaware people out there.
>
> Sure, that's why this is an option and it defaults to off.
>
>> Since init_ns is created at boot time before the sysctl can be
>> changed, we rather should not change the default behavior for init_ns.
>
> This could be a problem for built in drivers. With modules, I'm
> perfectly happy doing this in initrd :-)
>
> To behave consistently in all cases, we might consider adding a boot
> option for this, too, though.

Feel free to send a patch.

And do not forget we have many types of tunnels. So do not only patch gre.