Hacker News new | ask | show | jobs
by vijayp 3777 days ago
Oops I probably should have been clearer.

Hardware verification IS performed. For various reasons, the nic never itself drips packets that are corrupt, packets are instead marked by HW as either verified or unverified. When a packet is marked as unverified, the kernel should verify and potentially reject the packet before delivery to the application. The bug in the veth driver causes the kernel to treat packets marked unverified as "verified"

1 comments

If this problem affects all veth drivers, why does Docker's NAT IPv4 is safe?