netdev - Re: [PATCH net] ipv4: Update exception handling for multipath routes via same device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 7 Oct 2020 17:20:41 +0200
From:   Tobias Brunner <tobias@...ongswan.org>
To:     David Ahern <dsahern@...nel.org>, netdev@...r.kernel.org
Cc:     davem@...emloft.net, kuba@...nel.org,
        Kfir Itzhak <mastertheknife@...il.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Paul Wouters <paul@...ats.ca>
Subject: Re: [PATCH net] ipv4: Update exception handling for multipath routes
 via same device

Hi David,

> @@ -2668,8 +2673,6 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
>  	fib_select_path(net, res, fl4, skb);
>  
>  	dev_out = FIB_RES_DEV(*res);
> -	fl4->flowi4_oif = dev_out->ifindex;
> -
>  
>  make_route:
>  	rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);

This breaks some IPsec scenarios with interfaces in IPsec policies, an
example can be found under [1], where host moon configures policies with
eth0 as interface.  Without this assignment, however, packets don't
match these policies anymore and are sent unprotected (or won't get
blocked by the drop policy).

Regards,
Tobias

[1] https://www.strongswan.org/testing/testresults/swanctl/manual-prio/