Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: 19f5bb668fdf
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: 029e93391e53
Choose a head ref
  • 2 commits
  • 1 file changed
  • 1 contributor

Commits on Jul 31, 2020

  1. nixos/systemd-networkd-vrf: implement working TCP test on a 5.x kernel 

    By design, VRFs allow route-leaking for forwarded packages, but not for
local processes using a socket. While it was possible to leak such TCP
traffic through a VRF on a 4.x kernel, this behavior was considered
wrong and got fixed in Linux 5.x[1].

From now on, local unix sockets must run in the VRF itself using
`ip vrf exec`[2] which basically injects a BPF program into the VRF and
drops elevated networking capabilities by default for the specified
command.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c82a21f4320c8d54cf6456b27c8d49e5ffb722e
[2] https://man7.org/linux/man-pages/man8/ip-vrf.8.html
    @Ma27
    Ma27 committed Jul 31, 2020
    Copy the full SHA
    37e3cad View commit details
    Browse the repository at this point in the history

Commits on Aug 1, 2020

  1. Merge pull request #94369 from Ma27/vrf-tcp-test 

    nixos/systemd-networkd-vrf: implement working TCP test on a 5.x kernel
    @Ma27
    Ma27 committed Aug 1, 2020
    Copy the full SHA
    029e933 View commit details
    Browse the repository at this point in the history