netdev - Re: [PATCH net-next] ipv6: Allow the l3mdev to be a loopback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180919.212336.231776734640409407.davem@davemloft.net>
Date:   Wed, 19 Sep 2018 21:23:36 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     dsahern@...il.com
Cc:     mmanning@...tta.att-mail.com, netdev@...r.kernel.org,
        rshearma@...tta.att-mail.com
Subject: Re: [PATCH net-next] ipv6: Allow the l3mdev to be a loopback

From: David Ahern <dsahern@...il.com>
Date: Wed, 19 Sep 2018 10:19:05 -0700

> On 9/19/18 5:56 AM, Mike Manning wrote:
>> From: Robert Shearman <rshearma@...tta.att-mail.com>
>> 
>> There is no way currently for an IPv6 client connect using a loopback
>> address in a VRF, whereas for IPv4 the loopback address can be added:
>> 
>>     $ sudo ip addr add dev vrfred 127.0.0.1/8
>>     $ sudo ip -6 addr add ::1/128 dev vrfred
>>     RTNETLINK answers: Cannot assign requested address
>> 
>> So allow ::1 to be configured on an L3 master device. In order for
>> this to be usable ip_route_output_flags needs to not consider ::1 to
>> be a link scope address (since oif == l3mdev and so it would be
>> dropped), and ipv6_rcv needs to consider the l3mdev to be a loopback
>> device so that it doesn't drop the packets.
>> 
>> Signed-off-by: Robert Shearman <rshearma@...tta.att-mail.com>
>> Signed-off-by: Mike Manning <mmanning@...tta.att-mail.com>
>> ---
>>  net/ipv6/addrconf.c  | 1 +
>>  net/ipv6/ip6_input.c | 3 ++-
>>  net/ipv6/route.c     | 3 ++-
>>  3 files changed, 5 insertions(+), 2 deletions(-)
>> 
> 
> Reviewed-by: David Ahern <dsahern@...il.com>
> 
> Been on my to-do list for a while. Thanks for the patch. This resolves,
> for example, a harmless error message from the 'host' command from
> bind9-host-9.10.3 which probes for dscp support via the loopback
> address. e.g.,
> 
> $ host www.google.com
> ../../../../lib/isc/unix/net.c:581: sendmsg() failed: Network is unreachable

Applied, thanks everyone.