netdev - Re: [PATCH] sit: allow encapsulated IPv6 traffic to be delivered locally

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220112152340.4906baf8@kicinski-fedora-PC1C0HJN.hsd1.ca.comcast.net>
Date:   Wed, 12 Jan 2022 15:23:40 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     David Ahern <dsahern@...il.com>,
        Ignat Korchagin <ignat@...udflare.com>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>, kernel-team@...udflare.com,
        Amir Razmjou <arazmjou@...udflare.com>
Subject: Re: [PATCH] sit: allow encapsulated IPv6 traffic to be delivered
 locally

On Wed, 12 Jan 2022 12:59:37 -0700 David Ahern wrote:
> On 1/7/22 5:38 AM, Ignat Korchagin wrote:
> > While experimenting with FOU encapsulation Amir noticed that encapsulated IPv6
> > traffic fails to be delivered, if the peer IP address is configured locally.
> > 
> > It can be easily verified by creating a sit interface like below:
> > 
> > $ sudo ip link add name fou_test type sit remote 127.0.0.1 encap fou encap-sport auto encap-dport 1111
> > $ sudo ip link set fou_test up
> > 
> > and sending some IPv4 and IPv6 traffic to it
> > 
> > $ ping -I fou_test -c 1 1.1.1.1
> > $ ping6 -I fou_test -c 1 fe80::d0b0:dfff:fe4c:fcbc
> > 
> > "tcpdump -i any udp dst port 1111" will confirm that only the first IPv4 ping
> > was encapsulated and attempted to be delivered.
> > 
> > This seems like a limitation: for example, in a cloud environment the "peer"
> > service may be arbitrarily scheduled on any server within the cluster, where all
> > nodes are trying to send encapsulated traffic. And the unlucky node will not be
> > able to. Moreover, delivering encapsulated IPv4 traffic locally is allowed.
> > 
> > But I may not have all the context about this restriction and this code predates
> > the observable git history.
> > 
> > Reported-by: Amir Razmjou <arazmjou@...udflare.com>
> > Signed-off-by: Ignat Korchagin <ignat@...udflare.com>
> 
> Reviewed-by: David Ahern <dsahern@...nel.org>

Applied, thanks!