netdev - Re: veth pair ping fail if one of them enslaved into a VRF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190702192122.GA16784@splinter>
Date:   Tue, 2 Jul 2019 22:21:22 +0300
From:   Ido Schimmel <idosch@...sch.org>
To:     Zoltán Elek <elek.zoltan.dev@...il.com>
Cc:     netdev@...r.kernel.org, dsa@...ulusnetworks.com
Subject: Re: veth pair ping fail if one of them enslaved into a VRF

On Tue, Jul 02, 2019 at 08:42:15PM +0200, Zoltán Elek wrote:
> Hi!
> 
> I have a simple scenario, with a veth pair, IP addresses assigned from
> the same subnet. They can ping eachother. But when I put one of them
> into a VRF (in the example below, I put veth in-vrf into the test-vrf
> VRF) the ping fails. My first question: that is the expected behavior?
> And my second question: is there any way to overcome this?
> 
> Here are my test commands:
> ip link add out-of-vrf type veth peer name in-vrf
> ip link set dev out-of-vrf up
> ip link set dev in-vrf up
> ip link add test-vrf type vrf table 10
> ip link set dev test-vrf up
> ip -4 addr add 100.127.253.2/24 dev in-vrf
> ip -4 addr add 100.127.253.1/24 dev out-of-vrf
> 
> Then ping works as expected:
> ping -c1 -I 100.127.253.1 100.127.253.2
> 
> After I put the in-vrf into test-vrf, ping fails:
> ip link set in-vrf vrf test-vrf up

You need to re-order the FIB rules so that lookup for 100.127.253.1
happens in table 10 and not in the local table:

# ip -4 rule add pref 32765 table local
# ip -4 rule del pref 0
# ip -4 rule show 
1000:   from all lookup [l3mdev-table] 
32765:  from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default 

Bad:

ping 16735 [001] 13726.398115: fib:fib_table_lookup: table 255 oif 0 iif
9 proto 0 100.127.253.2/0 -> 100.127.253.1/0 tos 0 scope 0 flags 4 ==>
dev out-of-vrf gw 0.0.0.0 src 100.127.253.1 err 0

Good:

ping 16665 [001] 13500.937145: fib:fib_table_lookup: table 10 oif 0 iif
9 proto 0 100.127.253.2/0 -> 100.127.253.1/0 tos 0 scope 0 flags 4 ==>
dev in-vrf gw 0.0.0.0 src 100.127.253.2 err 0

> 
> Thanks,
> Zoltan Elek,
> VI1