From: David Ahern <dsahern@kernel.org>
To: Jakub Kicinski <kuba@kernel.org>,
Maximilien Cuony <maximilien.cuony@arcanite.ch>
Cc: netdev@vger.kernel.org, Phil Sutter <phil@nwl.cc>,
Florian Westphal <fw@strlen.de>,
Mike Manning <mvrmanning@gmail.com>,
netfilter-devel@vger.kernel.org
Subject: Re: [REGRESSION] Unable to NAT own TCP packets from another VRF with tcp_l3mdev_accept = 1
Date: Fri, 7 Oct 2022 08:42:21 -0600 [thread overview]
Message-ID: <c898f060-90f7-d6a5-4f3d-8d40428b5c83@kernel.org> (raw)
In-Reply-To: <20220930174237.2e89c9e1@kernel.org>
On 9/30/22 6:42 PM, Jakub Kicinski wrote:
> Adding netfilter and vrf experts.
>
> On Wed, 28 Sep 2022 16:02:43 +0200 Maximilien Cuony wrote:
>> Hello,
>>
>> We're using VRF with a machine used as a router and have a specific
>> issue where the router doesn't handle his own packets correctly during
>> NATing if the packet is coming from a different VRF.
>>
>> We had the issue with debian buster (4.19), but the issue solved itself
>> when we updated to debian bullseye (5.10.92).
>>
>> However, during an upgrade of debian bullseye to the latest kernel, the
>> issue appeared again (5.10.140).
>>
>> We did a bisection and this leaded us to
>> "b0d67ef5b43aedbb558b9def2da5b4fffeb19966 net: allow unbound socket for
>> packets in VRF when tcp_l3mdev_accept set [ Upstream commit
>> 944fd1aeacb627fa617f85f8e5a34f7ae8ea4d8e ]".
>>
This is the discussion that led up to that commit:
https://lore.kernel.org/netdev/940fa370-08ce-1d39-d5cc-51de8e853b47@gmail.com/
In short, users complained of the opposite problem.
Not sure how we can appease both wants.
next prev parent reply other threads:[~2022-10-07 14:42 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-28 14:02 [REGRESSION] Unable to NAT own TCP packets from another VRF with tcp_l3mdev_accept = 1 Maximilien Cuony
2022-09-30 7:36 ` Thorsten Leemhuis
2022-10-01 0:42 ` Jakub Kicinski
2022-10-07 14:42 ` David Ahern [this message]
2022-10-07 16:47 ` Mike Manning
2022-10-12 12:24 ` Maximilien Cuony
2022-10-26 12:40 ` [REGRESSION] Unable to NAT own TCP packets from another VRF with tcp_l3mdev_accept = 1 #forregzbot Thorsten Leemhuis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c898f060-90f7-d6a5-4f3d-8d40428b5c83@kernel.org \
--to=dsahern@kernel.org \
--cc=fw@strlen.de \
--cc=kuba@kernel.org \
--cc=maximilien.cuony@arcanite.ch \
--cc=mvrmanning@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.