netdev - Re: [PATCH net-next 0/5] vrf: allow simultaneous service instances in default and other VRFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fa020045-d2ca-2c44-eb47-e5c051b3fab5@gmail.com>
Date:   Thu, 20 Sep 2018 21:28:43 -0700
From:   David Ahern <dsahern@...il.com>
To:     Mike Manning <mmanning@...tta.att-mail.com>,
        netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Subject: Re: [PATCH net-next 0/5] vrf: allow simultaneous service instances in
 default and other VRFs

On 9/20/18 1:58 AM, Mike Manning wrote:
> Services currently have to be VRF-aware if they are using an unbound
> socket. One cannot have multiple service instances running in the
> default and other VRFs for services that are not VRF-aware and listen
> on an unbound socket. This is because there is no way of isolating
> packets received in the default VRF from those arriving in other VRFs.
> 
> This series provides this isolation subject to the existing kernel
> parameter net.ipv4.tcp_l3mdev_accept not being set, given that this is
> documented as allowing a single service instance to work across all
> VRF domains. The functionality applies to UDP & TCP services, for IPv4
> and IPv6, in particular adding VRF table handling for IPv6 multicast.
> 
> Example of running ssh instances in default and blue VRF:
> 
> $ /usr/sbin/sshd -D
> $ ip vrf exec vrf-blue /usr/sbin/sshd
> $ ss -ta | egrep 'State|ssh'
> State   Recv-Q   Send-Q           Local Address:Port       Peer Address:Port
> LISTEN  0        128           0.0.0.0%vrf-blue:ssh             0.0.0.0:*
> LISTEN  0        128                    0.0.0.0:ssh             0.0.0.0:*
> ESTAB   0        0              192.168.122.220:ssh       192.168.122.1:50282
> LISTEN  0        128              [::]%vrf-blue:ssh                [::]:*
> LISTEN  0        128                       [::]:ssh                [::]:*
> ESTAB   0        0           [3000::2]%vrf-blue:ssh           [3000::9]:45896
> ESTAB   0        0                    [2000::2]:ssh           [2000::9]:46398
> 

Hi Dave:

I need some time to review and more importantly test this patch set
before it is committed. I am traveling tomorrow afternoon through Sunday
evening, so I need a few days into next week to get to this.

Thanks,
David