netdev - Re: [PATCH net-next 0/7] net/ipv6: Fix route append and replace use cases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4140e322-39ad-3a1b-e6bf-9981f0310e02@gmail.com>
Date:   Mon, 2 Jul 2018 15:23:19 -0600
From:   David Ahern <dsahern@...il.com>
To:     David Miller <davem@...emloft.net>
Cc:     netdev@...r.kernel.org, Thomas.Winter@...iedtelesis.co.nz,
        idosch@...lanox.com, sharpd@...ulusnetworks.com,
        roopa@...ulusnetworks.com
Subject: Re: [PATCH net-next 0/7] net/ipv6: Fix route append and replace use
 cases

On 5/22/18 2:44 PM, David Ahern wrote:
> On 5/22/18 12:46 PM, David Miller wrote:
>>
>> Ok, I'll apply this series.
>>
>> But if this breaks things for anyone in a practical way, I am unfortunately
>> going to have to revert no matter how silly the current behavior may be.
>>
> 
> Understood. I have to try the best option first. I'll look at
> regressions if they happen.
> 

Debugging the problem Sowmini reported and I discovered NetworkManager
likes to manage link-local prefix routes (fe80::/64), and it likes to do
so with NLM_F_APPEND so the routes end up like this:

fe80::/64 dev eth0 proto kernel metric 100 pref medium
fe80::/64 dev eth1 proto kernel metric 101 pref medium
fe80::/64 proto kernel metric 256
        nexthop dev eth1 weight 1
        nexthop dev eth0 weight 1 pref medium

NM deletes the kernel installed routes, and then adds new ones -- twice:
once with the custom metric and then re-installs the route it deleted
but with the append flag.

Given the short amount of time left for 4.18 (and summer PTO), I think a
revert is the only option; we can try again in a future release.