lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 15 Mar 2018 10:35:42 -0400 From: Roman Mashak <mrv@...atatu.com> To: Liran Alon <liran.alon@...cle.com> Cc: <daniel@...earbox.net>, <netdev@...r.kernel.org>, <shmulik.ladkani@...il.com>, <davem@...emloft.net>, <linux-kernel@...r.kernel.org>, <yuval.shaia@...cle.com>, <idan.brown@...cle.com> Subject: Re: [PATCH] net: dev_forward_skb(): Scrub packet's per-netns info only when crossing netns Liran Alon <liran.alon@...cle.com> writes: [...] >> Overall I think it might be nice to not need scrubbing skb in such >> cases, >> although my concern would be that this has potential to break >> existing >> setups when they would expect mark being zero on other veth peer in >> any >> case since it's the behavior for a long time already. The safer >> option >> would be to have some sort of explicit opt-in e.g. on link creation to >> let >> the skb->mark pass through unscrubbed. This would definitely be a >> useful >> option e.g. when mark is set in the netns facing veth via >> clsact/egress >> on xmit and when the container is unprivileged anyway. >> >> Thanks, >> Daniel > > I see your point in regards to backwards comparability. > However, not scrubbing skb when it cross netns via some kernel functions compared to > others is basically a bug which could easily break with a little bit of more refactoring. > Therefore, it seems a bit weird to me to from now on, we will force > every user on link creation to consider that once there was a bug leading > to this weird behavior on specific netdevs. > Thus, I suggest to maybe control this via a global /proc/sys/net file instead. One valid use case could be preserving a source namespace nsid in skb->mark when a packet crosses netns.
Powered by blists - more mailing lists