On Tue, Aug 23, 2016 at 05:33:49PM +0200, Jiri Benc wrote: > On Tue, 23 Aug 2016 18:28:05 +0300, Amir Vadai wrote: > > On Mon, Aug 22, 2016 at 08:51:37PM +0200, Jiri Benc wrote: > > > 2. We may run into problems like tx path seeing the metadata_dst that > > > it should not see. This means either this situation or such > > > configuration must be prevented somehow. > [...] > > Anyway, this issue is orthogonal to this patchset... > > Not really. If it's indeed (2) then such configuration needs to be > rejected. The configuration that needs to be rejected is when act_iptunnel is not used. So, I guess the fix won't be part of it...
> Or metadata_dst freed at an appropriate place. Thus it's > something that needs to be handled by this patchset before the uAPI is > set in stone. It is already there - user can use act_mirred and redirect skb's with metadata since shared tunnel devices introduced. The only thing that was added here, is to enable the user to drop the metadata, which I think we agree is the ok. But I agree with you, that I must understand the life cycle of the metadata and dst better. I will try to understand it better and explain/fix accordingly. Again, would be happy if someone will chime in and give some hints if it was a bug, that a user could redirect skb's with metadata, or something harmless. Thanks, Amir > > Jiri
