netdev - Re: [PATCHv4 net-next 16/16] sctp: enable udp tunneling socks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADvbK_cZua_+2e=u--cV4jH5tR=24DvcEtwcHfAp1kyq9sYofA@mail.gmail.com>
Date:   Thu, 22 Oct 2020 11:12:57 +0800
From:   Xin Long <lucien.xin@...il.com>
To:     Michael Tuexen <tuexen@...muenster.de>
Cc:     Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        network dev <netdev@...r.kernel.org>,
        linux-sctp@...r.kernel.org, Neil Horman <nhorman@...driver.com>,
        davem <davem@...emloft.net>, Guillaume Nault <gnault@...hat.com>,
        Paolo Abeni <pabeni@...hat.com>,
        Willem de Bruijn <willemdebruijn.kernel@...il.com>
Subject: Re: [PATCHv4 net-next 16/16] sctp: enable udp tunneling socks

On Wed, Oct 21, 2020 at 5:13 PM Michael Tuexen <tuexen@...muenster.de> wrote:
>
> > On 21. Oct 2020, at 06:16, Xin Long <lucien.xin@...il.com> wrote:
> >
> > On Wed, Oct 21, 2020 at 5:23 AM Marcelo Ricardo Leitner
> > <marcelo.leitner@...il.com> wrote:
> >>
> >> On Tue, Oct 20, 2020 at 11:15:26PM +0200, Michael Tuexen wrote:
> >>>> On 20. Oct 2020, at 23:11, Marcelo Ricardo Leitner <marcelo.leitner@...il.com> wrote:
> >>>>
> >>>> On Tue, Oct 20, 2020 at 05:12:06PM +0800, Xin Long wrote:
> >>>>> On Tue, Oct 20, 2020 at 6:15 AM Marcelo Ricardo Leitner
> >>>>> <marcelo.leitner@...il.com> wrote:
> >>>>>>
> >>>>>> On Mon, Oct 19, 2020 at 08:25:33PM +0800, Xin Long wrote:
> >>>>>>> --- a/Documentation/networking/ip-sysctl.rst
> >>>>>>> +++ b/Documentation/networking/ip-sysctl.rst
> >>>>>>> @@ -2640,6 +2640,12 @@ addr_scope_policy - INTEGER
> >>>>>>>
> >>>>>>>     Default: 1
> >>>>>>>
> >>>>>>> +udp_port - INTEGER
> >>>>>>
> >>>>>> Need to be more verbose here, and also mention the RFC.
> >>>>>>
> >>>>>>> +     The listening port for the local UDP tunneling sock.
> >>>>>>       , shared by all applications in the same net namespace.
> >>>>>>> +     UDP encapsulation will be disabled when it's set to 0.
> >>>>>>
> >>>>>>       "Note, however, that setting just this is not enough to actually
> >>>>>>       use it. ..."
> >>>>> When it's a client, yes,  but when it's a server, the encap_port can
> >>>>> be got from the incoming packet.
> >>>>>
> >>>>>>
> >>>>>>> +
> >>>>>>> +     Default: 9899
> >>>>>>> +
> >>>>>>> encap_port - INTEGER
> >>>>>>>     The default remote UDP encapsalution port.
> >>>>>>>     When UDP tunneling is enabled, this global value is used to set
> >>>>>>
> >>>>>> When is it enabled, which conditions are needed? Maybe it can be
> >>>>>> explained only in the one above.
> >>>>> Thanks!
> >>>>> pls check if this one will be better:
> >>>>
> >>>> It is. Verbose enough now, thx.
> >>>> (one other comment below)
> >>>>
> >>>>>
> >>>>> udp_port - INTEGER
> >>>>>
> >>>>> The listening port for the local UDP tunneling sock.
> >>>>>
> >>>>> This UDP sock is used for processing the incoming UDP-encapsulated
> >>>>> SCTP packets (from RFC6951), and shared by all applications in the
> >>>>> same net namespace. This UDP sock will be closed when the value is
> >>>>> set to 0.
> >>>>>
> >>>>> The value will also be used to set the src port of the UDP header
> >>>>> for the outgoing UDP-encapsulated SCTP packets. For the dest port,
> >>>>> please refer to 'encap_port' below.
> >>>>>
> >>>>> Default: 9899
> >>>>
> >>>> I'm now wondering if this is the right default. I mean, it is the
> >>>> standard port for it, yes, but at the same time, it means loading SCTP
> >>>> module will steal/use that UDP port on all net namespaces and can lead
> >>>> to conflicts with other apps. A more conservative approach here is to
> >>>> document the standard port, but set the default to 0 and require the
> >>>> user to set it in if it is expected to be used.
> >>>>
> >>>> Did FreeBSD enable it by default too?
> >>> No. The default is 0, which means that the encapsulation is turned off.
> >>> Setting this sysctl variable to a non-zero value enables the UDP tunneling
> >>> with the given port.
> >>
> >> Thanks Michael.
> >> Xin, then we should change this default value (and update the
> >> documentation above accordingly, to still have the standard port #
> >> readily available in there).
> > OK, I misunderstood the RFC.
> Does that RFC mandate that the feature is on by default? Can you point me to
> that text?
Not really.

I was thinking that by leaving it to 9899 by default users don't need to
know the port when want to use it, and yet I didn't want to add another
sysctl member. :D

>
> Best regards
> Michael
> >
> > I will remove the call to sctp_udp_sock_start/stop() from
> > sctp_ctrlsock_init/exit(), and set the udp_port as 0 by default.
> >
> > Thanks.
>