netdev - Re: VRF leaking doesn't work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADbyt64HpzGf6A_=wrouL+vT73DBndww34gMPSH9jDOiGEysvQ@mail.gmail.com>
Date:   Wed, 10 Mar 2021 09:34:07 +0100
From:   Greesha Mikhalkin <grigoriymikhalkin@...il.com>
To:     David Ahern <dsahern@...il.com>
Cc:     netdev@...r.kernel.org
Subject: Re: VRF leaking doesn't work

I see. When i do `ping -I vrf2` to address that was leaked from vrf1
it selects source address that's set as local in vrf1 routing table.
Is this expected behavior? I guess, forwarding packets from vrf1 to
vrf2 local address won't help here.

6 mar. 2021 - 17:12, David Ahern <dsahern@...il.com>:

>
> On 3/2/21 3:57 AM, Greesha Mikhalkin wrote:
> > Main goal is that 100.255.254.3 should be reachable from vrf2. But
> > after this setup it doesn’t work. When i run `ping -I vrf2
> > 100.255.254.3` it sends packets from source address that belongs to
> > vlan1 enslaved by vrf1. I can see in tcpdump that ICMP packets are
> > sent and then returned to source address but they're not returned to
> > ping command for some reason. To be clear `ping -I vrf1 …` works fine.
>
> I remember this case now: VRF route leaking works for fowarding, but not
> local traffic. If a packet arrives in vrf2, it should get forwarded to
> vrf1 and on to its destination. If the reverse route exists then round
> trip traffic works.