netdev - Re: [PATCH net-next v5 0/9] vrf: allow simultaneous service instances in default and other VRFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20181107.161348.1452886439639762613.davem@davemloft.net>
Date:   Wed, 07 Nov 2018 16:13:48 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     mmanning@...tta.att-mail.com
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net-next v5 0/9] vrf: allow simultaneous service
 instances in default and other VRFs

From: Mike Manning <mmanning@...tta.att-mail.com>
Date: Wed,  7 Nov 2018 15:36:01 +0000

> Services currently have to be VRF-aware if they are using an unbound
> socket. One cannot have multiple service instances running in the
> default and other VRFs for services that are not VRF-aware and listen
> on an unbound socket. This is because there is no easy way of isolating
> packets received in the default VRF from those arriving in other VRFs.
> 
> This series provides this isolation for stream sockets subject to the
> existing kernel parameter net.ipv4.tcp_l3mdev_accept not being set,
> given that this is documented as allowing a single service instance to
> work across all VRF domains. Similarly, net.ipv4.udp_l3mdev_accept is
> checked for datagram sockets, and net.ipv4.raw_l3mdev_accept is
> introduced for raw sockets. The functionality applies to UDP & TCP
> services as well as those using raw sockets, and is for IPv4 and IPv6.
> 
> Example of running ssh instances in default and blue VRF:
 ...

Series applied, thanks Mike.