netdev - ip rule iif oif and vrf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Sep 2020 09:11:22 -0400
From:   Stephen Suryaputra <ssuryaextr@...il.com>
To:     netdev@...r.kernel.org, dsahern@...il.com
Subject: ip rule iif oif and vrf

Hi,

We have a use case where there are multiple user VRFs being leak routed
to and from tunnels that are on the core VRF. Traffic from user VRF to a
tunnel can be done the normal way by specifying the netdev directly on
the route entry on the user VRF route table:

ip route add <prefix> via <tunnel_end_point_addr> dev <tunnel_netdev>

But traffic received on the tunnel must be leak routed directly to the
respective a specific user VRF because multiple user VRFs can have
duplicate address spaces. I am thinking of using ip rule but when the
iif is an enslaved device, the rule doesn't get matched because the
ifindex in the skb is the master.

My question is: is this a bug, or is there anything else that can be
done to make sure that traffic from a tunnel being routed directly to a
user VRF? If it is the later, I can work on a patch.

Thank you,

Stephen.