netdev - Re: [PATCHv4 net-next 16/16] sctp: enable udp tunneling socks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Oct 2020 19:13:49 -0300
From:   'Marcelo Ricardo Leitner' <marcelo.leitner@...il.com>
To:     David Laight <David.Laight@...lab.com>
Cc:     Michael Tuexen <tuexen@...muenster.de>,
        Xin Long <lucien.xin@...il.com>,
        network dev <netdev@...r.kernel.org>,
        "linux-sctp@...r.kernel.org" <linux-sctp@...r.kernel.org>,
        Neil Horman <nhorman@...driver.com>,
        davem <davem@...emloft.net>, Guillaume Nault <gnault@...hat.com>,
        Paolo Abeni <pabeni@...hat.com>,
        Willem de Bruijn <willemdebruijn.kernel@...il.com>
Subject: Re: [PATCHv4 net-next 16/16] sctp: enable udp tunneling socks

On Tue, Oct 20, 2020 at 10:08:17PM +0000, David Laight wrote:
> From: Marcelo Ricardo Leitner
> > Sent: 20 October 2020 22:24
> ...
> > > > Did FreeBSD enable it by default too?
> > > No. The default is 0, which means that the encapsulation is turned off.
> > > Setting this sysctl variable to a non-zero value enables the UDP tunneling
> > > with the given port.
> > 
> > Thanks Michael.
> > Xin, then we should change this default value (and update the
> > documentation above accordingly, to still have the standard port #
> > readily available in there).
> 
> Does that mean that you can't have some 'normal' connections and
> others that use UDP encapsulation?
> Seems a pretty strong restriction.

That's not what was said. Just that the socket shouldn't be created by
default.

> 
> (I'm waiting for one of our customers to ask for this...)

It can. The setting in question is for receiving encapsulated packets,
and which doesn't exclude the standard one. It can still receive
normal/non-encapsulated packets.