linux/include/net/netns
Robert Shearman 63a6fff353 net: Avoid receiving packets with an l3mdev on unbound UDP sockets
Packets arriving in a VRF currently are delivered to UDP sockets that
aren't bound to any interface. TCP defaults to not delivering packets
arriving in a VRF to unbound sockets. IP route lookup and socket
transmit both assume that unbound means using the default table and
UDP applications that haven't been changed to be aware of VRFs may not
function correctly in this case since they may not be able to handle
overlapping IP address ranges, or be able to send packets back to the
original sender if required.

So add a sysctl, udp_l3mdev_accept, to control this behaviour with it
being analgous to the existing tcp_l3mdev_accept, namely to allow a
process to have a VRF-global listen socket. Have this default to off
as this is the behaviour that users will expect, given that there is
no explicit mechanism to set unmodified VRF-unaware application into a
default VRF.

Signed-off-by: Robert Shearman <rshearma@brocade.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Tested-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-30 15:00:58 -05:00
..
conntrack.h netfilter: conntrack: built-in support for UDPlite 2016-12-04 20:57:36 +01:00
core.h
dccp.h
generic.h netns: fix net_generic() "id - 1" bloat 2016-12-03 15:59:58 -05:00
hash.h netns: constify net_hash_mix() and various callers 2015-03-18 22:00:34 -04:00
ieee802154_6lowpan.h ieee802154: 6lowpan: ensure MTU of 1280 for 6lowpan 2014-08-19 19:17:42 +02:00
ipv4.h net: Avoid receiving packets with an l3mdev on unbound UDP sockets 2017-01-30 15:00:58 -05:00
ipv6.h ipv6: sr: add code base for control plane support of SR-IPv6 2016-11-09 20:40:06 -05:00
mib.h
mpls.h mpls: Add a sysctl to control the size of the mpls label table 2015-03-04 00:26:06 -05:00
netfilter.h netfilter: defrag: only register defrag functionality if needed 2016-12-06 21:42:00 +01:00
nftables.h netfilter: nf_tables: add netdev table to filter from ingress 2015-05-26 18:41:23 +02:00
packet.h
sctp.h sctp: add reconf_enable in asoc ep and netns 2017-01-18 14:55:10 -05:00
unix.h
x_tables.h netfilter: don't pull include/linux/netfilter.h from netns headers 2015-06-18 21:14:31 +02:00
xfrm.h xfrm: state: remove per-netns gc task 2016-08-24 13:16:06 +02:00