netdev - Re: [PATCH net v3 0/2] ipv6: Fix listing and flushing of cached route exceptions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <956e4bc4-c916-c069-cd5d-b8f4b309a437@gmail.com>
Date:   Tue, 11 Jun 2019 15:09:05 -0600
From:   David Ahern <dsahern@...il.com>
To:     Martin Lau <kafai@...com>, Stefano Brivio <sbrivio@...hat.com>
Cc:     David Miller <davem@...emloft.net>, Jianlin Shi <jishi@...hat.com>,
        Wei Wang <weiwan@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Matti Vaittinen <matti.vaittinen@...rohmeurope.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH net v3 0/2] ipv6: Fix listing and flushing of cached route
 exceptions

On 6/11/19 2:19 PM, Martin Lau wrote:
> On Tue, Jun 11, 2019 at 12:47:58AM +0200, Stefano Brivio wrote:
>> On Mon, 10 Jun 2019 23:53:15 +0200
>> Stefano Brivio <sbrivio@...hat.com> wrote:
>>
>>> On Mon, 10 Jun 2019 15:38:06 -0600
>>> David Ahern <dsahern@...il.com> wrote:
>>>
>>>> in dot releases of stable trees, I think it would be better to converge
>>>> on consistent behavior between v4 and v6. By that I mean without the
>>>> CLONED flag, no exceptions are returned (default FIB dump). With the
>>>> CLONED flag only exceptions are returned.  
>>>
>>> Again, this needs a change in iproute2, because RTM_F_CLONED is *not*
>>> passed on 'flush'. And sure, let's *also* do that, but not everybody
>>> runs recent versions of iproute2.
>>
>> One thing that sounds a bit more acceptable to me is:
>>
>> - dump (in IPv4 and IPv6):
>>   - regular routes only, if !RTM_F_CLONED and NLM_F_MATCH
>>   - exceptions only, if RTM_F_CLONED and NLM_F_MATCH
> That seems reasonable since DavidAhern pointed out iproute2 already has
> #define NLM_F_DUMP      (NLM_F_ROOT|NLM_F_MATCH)
> 
>>   - everything if !NLM_F_MATCH
> I am not sure how may the kernel change looks like.  At least I don't
> see the current ipv6/route.c or ipv6/ip6_fib.c is handling
> nlmsg_flags.  I would defer to DavidAhern for comment.

We might be battling change histories in 2 different code bases. We
should compare behaviors of kernel and iproute2 for 4.14 (pre-change),
4.15 (change), 4.19 (LTS), 5.0 (strict checking) and 5.2 and then look
at what the proposed kernel change does with the various iproute2 versions.