Maximilian Bosch 37e3cadb8b
nixos/systemd-networkd-vrf: implement working TCP test on a 5.x kernel
By design, VRFs allow route-leaking for forwarded packages, but not for
local processes using a socket. While it was possible to leak such TCP
traffic through a VRF on a 4.x kernel, this behavior was considered
wrong and got fixed in Linux 5.x[1].

From now on, local unix sockets must run in the VRF itself using
`ip vrf exec`[2] which basically injects a BPF program into the VRF and
drops elevated networking capabilities by default for the specified
command.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c82a21f4320c8d54cf6456b27c8d49e5ffb722e
[2] https://man7.org/linux/man-pages/man8/ip-vrf.8.html
2020-07-31 21:06:00 +02:00
..
2020-06-30 17:12:03 +02:00
2020-05-04 00:14:42 +02:00
2020-05-14 20:54:12 +01:00
2020-07-29 19:45:03 +02:00
2020-05-22 11:23:31 +02:00
2020-07-23 12:05:52 +02:00
2020-06-22 13:58:35 +02:00
2020-05-04 15:56:06 -07:00
2020-05-24 15:45:22 +02:00
2020-05-26 21:47:31 +02:00
2020-06-04 01:44:33 +02:00
2020-07-06 18:35:34 +02:00
2020-06-08 21:35:47 +02:00
2020-06-08 21:35:47 +02:00
2020-07-24 11:04:33 +02:00
2020-07-24 11:44:16 -04:00
2020-06-14 01:09:33 +02:00
2020-05-09 12:11:44 +02:00
2020-05-08 07:40:38 -07:00
2020-07-29 19:45:03 +02:00
2020-06-23 12:02:27 +02:00
2020-05-12 18:49:43 +02:00
2020-06-20 13:24:19 +02:00
2020-06-23 16:49:50 +02:00
2020-06-19 16:44:21 +02:00