netdev - veth pair ping fail if one of them enslaved into a VRF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 2 Jul 2019 20:42:15 +0200
From:   Zoltán Elek <elek.zoltan.dev@...il.com>
To:     netdev@...r.kernel.org, dsa@...ulusnetworks.com
Subject: veth pair ping fail if one of them enslaved into a VRF

Hi!

I have a simple scenario, with a veth pair, IP addresses assigned from
the same subnet. They can ping eachother. But when I put one of them
into a VRF (in the example below, I put veth in-vrf into the test-vrf
VRF) the ping fails. My first question: that is the expected behavior?
And my second question: is there any way to overcome this?

Here are my test commands:
ip link add out-of-vrf type veth peer name in-vrf
ip link set dev out-of-vrf up
ip link set dev in-vrf up
ip link add test-vrf type vrf table 10
ip link set dev test-vrf up
ip -4 addr add 100.127.253.2/24 dev in-vrf
ip -4 addr add 100.127.253.1/24 dev out-of-vrf

Then ping works as expected:
ping -c1 -I 100.127.253.1 100.127.253.2

After I put the in-vrf into test-vrf, ping fails:
ip link set in-vrf vrf test-vrf up

Thanks,
Zoltan Elek,
VI1