netdev - Re: VRF + ip xfrm, egress ESP packet looping when qdisc configured

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHgT=KdW3hNy4pE+prSA1WyKNu0Ni8qg0SSbxWQ_Dx0RjcPLdA@mail.gmail.com>
Date:   Mon, 6 Jan 2020 00:58:14 -0500
From:   Trev Larock <trev@...ock.ca>
To:     David Ahern <dsahern@...il.com>
Cc:     Trev Larock <trev@...ock.ca>, netdev@...r.kernel.org,
        Ben Greear <greearb@...delatech.com>
Subject: Re: VRF + ip xfrm, egress ESP packet looping when qdisc configured

On Sun, Jan 5, 2020 at 11:29 PM David Ahern <dsahern@...il.com> wrote:
> I was able to adapt your commands with the above and reproduced the
> problem. I need to think about the proper solution.
>
Ok thanks for investigating.

> Also, I looked at my commands from a few years ago (IPsec with VRF) and
> noticed you are not adding a device context to the xfrm policy and
> state. e.g.,
>
Yes was part of my original query, that makes sense in order to be able to have
multiple vrf each with their own xfrm policies.
I will investigate further on it.  The oif passed to xfrm_lookup seemed to be
enp0s8 oif rather than vrf0 oif, so I was observing just cleartext
pings go out / policy wouldn't match.
Perhaps I'm missing something to get vrf0 oif passed for the ping packet.

Thanks,
Trev