On 9/24/18 10:13 AM, Mike Manning wrote:
> From: Robert Shearman <[email protected]>
>
> There is no easy way currently for applications that want to receive
> packets in the default VRF to be isolated from packets arriving in
> VRFs, which makes using VRF-unaware applications in a VRF-aware system
> a potential security risk.
That comment is not correct.
The point of the l3mdev sysctl's is to prohibit this case. Setting
net.ipv4.{tcp,udp}_l3mdev_accept=0 means that a packet arriving on an
interface enslaved to a VRF can not be received by a global socket.
Setting the l3mdev to 1 allows the default socket to work across VRFs.
If that is not what you want for a given app or a given VRF, then one
option is to add netfilter rules on the VRF device to prohibit it. I
just verified this works for both tcp and udp.
Further, overlapping binds are allowed using SO_REUSEPORT meaning I can
have a server running in the default vrf bound to a port AND a server
running bound to a specific vrf and the same port:
udp UNCONN 0 0 *%red:12345 *:*
users:(("vrf-test",pid=1376,fd=3))
udp UNCONN 0 0 *:12345 *:*
users:(("vrf-test",pid=1375,fd=3))
tcp LISTEN 0 1 *%red:12345 *:*
users:(("vrf-test",pid=1356,fd=3))
tcp LISTEN 0 1 *:12345 *:*
users:(("vrf-test",pid=1352,fd=3))
For packets arriving on an interface enslaved to a VRF the socket lookup
will pick the VRF server over the global one.
--
With this patch set I am seeing a number of tests failing -- socket
connections working when they should not or not working when they
should. I only skimmed the results. I am guessing this patch is the
reason, but that is just a guess.
You need to make sure all permutations of:
1. net.ipv4.{tcp,udp}_l3mdev_accept={0,1},
2. connection in the default VRF and in a VRF,
3. locally originated and remote traffic,
4. ipv4 and ipv6
continue to work as expected meaning packets flow when they should and
fail with the right error when they should not. I believe the UDP cases
were the main ones failing.
Given the test failures, I did not look at the code changes in the patch.
