netdev - Re: [PATCH net-next 1/2] UDP tunnel encapsulation module for tunnelling different protocols like MPLS,IP,NSH etc.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191114131749.GA9443@martin-VirtualBox>
Date:   Thu, 14 Nov 2019 18:47:49 +0530
From:   Martin Varghese <martinvarghesenokia@...il.com>
To:     Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc:     Network Development <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Jonathan Corbet <corbet@....net>, scott.drennan@...ia.com,
        Jiri Benc <jbenc@...hat.com>, martin.varghese@...ia.com
Subject: Re: [PATCH net-next 1/2] UDP tunnel encapsulation module for
 tunnelling different protocols like MPLS,IP,NSH etc.

On Mon, Nov 11, 2019 at 04:45:30PM -0500, Willem de Bruijn wrote:
> On Mon, Nov 11, 2019 at 11:02 AM Martin Varghese
> <martinvarghesenokia@...il.com> wrote:
> >
> > On Thu, Nov 07, 2019 at 11:35:07AM -0500, Willem de Bruijn wrote:
> > > On Thu, Nov 7, 2019 at 11:12 AM Martin Varghese
> > > <martinvarghesenokia@...il.com> wrote:
> > > >
> > > > On Thu, Nov 07, 2019 at 10:53:47AM -0500, Willem de Bruijn wrote:
> > > > > > > I do think that with close scrutiny there is a lot more room for code
> > > > > > > deduplication. Just look at the lower half of geneve_rx and
> > > > > > > bareudp_udp_encap_recv, for instance. This, too, is identical down to
> > > > > > > the comments. Indeed, is it fair to say that geneve was taken as the
> > > > > > > basis for this device?
> > > > > > >
> > > > > > > That said, even just avoiding duplicating those routing functions
> > > > > > > would be a good start.
> > > > > > >
> > > > > > > I'm harping on this because in other examples in the past where a new
> > > > > > > device was created by duplicating instead of factoring out code
> > > > > > > implementations diverge over time in bad ways due to optimizations,
> > > > > > > features and most importantly bugfixes being applied only to one
> > > > > > > instance or the other. See for instance tun.c and tap.c.
> > > > > > >
> > > > > > > Unrelated, an ipv6 socket can receive both ipv4 and ipv6 traffic if
> > > > > > > not setting the v6only bit, so does the device need to have separate
> > > > > > > sock4 and sock6 members? Both sockets currently lead to the same
> > > > > > > bareudp_udp_encap_recv callback function.
> > > > > >
> > > > > > I was checking this.AF_INET6 allows v6 and v4 mapped v6 address.
> > > > > > And it doesnot allow both at the same time.So we need both
> > > > > > sockets to support v4 and v6 at the same time.correct ?
> > > > >
> > > > > bareudp_create_sock currently creates an inet socket listening on
> > > > > INADDR_ANY and an inet6 socket listening on in6addr_any with v6only.
> > > > > If so, just the latter without v6only should offer the same.
> > > >
> > > > To receive and ipv4 packet in AF_INET6 packet we need to pass v4 address
> > > > in v6 format( v4 mapped v6 address). Is it not ?
> > >
> > > If the bareudp device binds to a specific port on all local addresses,
> > > which I think it's doing judging from what it passes to udp_sock_create
> > > (but I may very well be missing something), then in6addr_any alone will
> > > suffice to receive both v6 and v4 packets.
> >
> > Must invokde udp_encap_enable explicitly from baredudp module during setup time.
> > Otherwise v4 packets will not land in encap_rcv handler.
> 
> The call to setup_udp_tunnel_sock should take care of that. The issue
> is probably that in udp_tunnel_encap_enable:
> 
>   #if IS_ENABLED(CONFIG_IPV6)
>         if (sock->sk->sk_family == PF_INET6)
>                 ipv6_stub->udpv6_encap_enable();
>         else
>   #endif
>                 udp_encap_enable();
> 
> does not call udp_encap_enable for IPv6 sockets. Likely because
> existing callers like vxlan always pass v6only = 1. Due to dual stack,
> PF_INET6 should enable both static keys.

Thanks for your time.