netdev - Re: [PATCH net-next 00/11] ICMP error handling for UDP tunnels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181107120951.2a9af149@redhat.com>
Date:   Wed, 7 Nov 2018 12:09:51 +0100
From:   Jiri Benc <jbenc@...hat.com>
To:     Stefano Brivio <sbrivio@...hat.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Sabrina Dubroca <sd@...asysnail.net>,
        Xin Long <lucien.xin@...il.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 00/11] ICMP error handling for UDP tunnels

On Tue,  6 Nov 2018 22:38:56 +0100, Stefano Brivio wrote:
> - patch 1/11 adds a socket lookup for UDP tunnels that use, by design,
>   the same destination port on both endpoints -- i.e. VxLAN and GENEVE

This is not necessarily true with lwtunnels (collect_md mode of VXLAN
and GENEVE). While any sane setup will use the same dst ports, there's
really nothing that enforces it. Of course, in that case we have no way
to map the ICMP error back to the tunnel.

Generally speaking, I'm not sure how ICMP error handling should work
for external control planes. Are we sure they want PMTU discovery and
route redirection done by the kernel? (I am not sure, neither way.)

Jiri