netdev - Re: vrf and multicast is broken in some cases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200115191920.GA1490933@splinter>
Date:   Wed, 15 Jan 2020 21:19:20 +0200
From:   Ido Schimmel <idosch@...sch.org>
To:     Ben Greear <greearb@...delatech.com>
Cc:     David Ahern <dsahern@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: vrf and multicast is broken in some cases

On Wed, Jan 15, 2020 at 11:02:26AM -0800, Ben Greear wrote:
> 
> 
> On 01/15/2020 10:45 AM, David Ahern wrote:
> > On 1/15/20 10:57 AM, Ben Greear wrote:
> > > Hello,
> > > 
> > > We put two different ports into their own VRF, and then tried to run a
> > > multicast
> > > sender on one and receiver on the other.  The receiver does not receive
> > > anything.
> > > 
> > > Is this a known problem?
> > > 
> > > If we do a similar setup with policy based routing rules instead of VRF,
> > > then the multicast
> > > test works.
> > > 
> > 
> > It works for OSPF for example. I have lost track of FRR features that
> > use it, so you will need to specify more details.
> > 
> > Are the sender / receiver on the same host?
> 
> Yes, like eth2 sending to eth3, eth2 is associated with _vrf2, eth3 with _vrf3.

Two questions:

1. Did you re-order the FIB rules so that l3mdev rule is before the main
table?
2. Did you configure a default unreachable route in the VRF?

IIRC, locally generated multicast packets are forwarded according to the
unicast FIB rules, so if you don't have the unreachable route, it is
possible the packet is forwarded according to the default route in the
main table.

> 
> I'll go poking at the code.
> 
> Thanks,
> Ben
> 
> -- 
> Ben Greear <greearb@...delatech.com>
> Candela Technologies Inc  http://www.candelatech.com