[Devel,RHEL7,COMMIT] ve/net/sctp: allow using SCTP inside Containers

Submitted by Konstantin Khorenko on Sept. 12, 2016, 2:04 p.m.


Message ID 201609121404.u8CE4P82014985@finist_cl7.x64_64.work.ct
State New
Series "ve/net/sctp: allow using SCTP inside Containers"
Headers show

Commit Message

Konstantin Khorenko Sept. 12, 2016, 2:04 p.m.
The commit is pushed to "branch-rh7-3.10.0-327.28.2.vz7.17.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.28.2.vz7.17.5
commit 6e949ca88971f45d7104dd37d2f9a84dcd8d35f7
Author: Konstantin Khorenko <khorenko@virtuozzo.com>
Date:   Mon Sep 12 18:04:25 2016 +0400

    ve/net/sctp: allow using SCTP inside Containers
    SCTP support of network namespaces appeared in 3.7 kernel =>
    all we need is to enable it inside Containers.
    Note 1: sctp module is NOT included into the autoload modules list
    => hoster needs to preload the "sctp" module on the host before
    CT owners are able to use it. This is done on purpose and not going
    to be changed in a while. Reason: too many security issues found in sctp
    protocol implementation last year.
    Note 2: CRIU does not support SCTP => online migration is known to fail
    in case SCTP sockets are used.
    Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
 kernel/ve/ve.c | 1 +
 1 file changed, 1 insertion(+)

Patch hide | download patch | download mbox

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 0461790..8afff3d 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -216,6 +216,7 @@  int vz_security_protocol_check(struct net *net, int protocol)
 	case  IPPROTO_GRE:
 	case  IPPROTO_ESP:
 	case  IPPROTO_AH:
 		return 0;
 		return -EAFNOSUPPORT;