netdev - Re: [PATCH net-next] vrf: local route leaking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8012f642-4118-7386-a60a-a4e4a4f18f87@gmail.com>
Date:   Fri, 31 May 2019 08:54:03 -0600
From:   David Ahern <dsahern@...il.com>
To:     George Wilkie <gwilkie@...tta.att-mail.com>
Cc:     Shrijeet Mukherjee <shrijeet@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next] vrf: local route leaking

On 5/31/19 4:38 AM, George Wilkie wrote:
> What are your thoughts on creating a "vrfdefault" for "local" table?
>    ip link add vrfdefault type vrf table local
>    ip link set dev vrfdefault up
>    ip ro add vrf vrfA 10.10.3.0/24 dev vrfdefault
>    ip ro add 10.10.2.0/24 dev vrfA
>    ip -6 ro add vrf vrfA 10:10:3::/64 dev vrfdefault
>    ip -6 ro add 10:10:2::/64 dev vrfA
> 
> I'm able to reach local and peer addresses for both v4 and v6 with this
> approach.

Robert looked into that some time back. I was not aware it is working,
but if it does, great.