netdev - What is the best way to accomplish "decapsulate any" functionality?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 28 Jul 2014 11:26:32 -0700
From:	Alex Gartrell <agartrell@...com>
To:	<lvs-devel@...r.kernel.org>, <netdev@...r.kernel.org>
CC:	<kernel-team@...com>, <ps@...com>
Subject: What is the best way to accomplish "decapsulate any" functionality?

Short Version:

What's the best way to accomplish "decapsulate any" functionality for
"IPv{4,6} in IPv{4,6}?"  Should I write an xfrm module or is there a
simple, existing method?

Long Version:

We've been using IPVS with ipip tunneling for ages, and it's been great,
but our decapsulation story has always been a little weak.  At some point,
someone figured out that if you create tunnel interfaces for both v4 and v6
and add loopback or link-local unicast addresses to each, the kernel will
magically start decapsulating these packets for you, and you can put your
virtual IPs on any dummy interface you want (or loopback).

So our load balancer's pre-run script basically boils down to:
ip tunnel add mode ipip
ip addr add dev tunl0 127.0.0.101/32
ip link set dev tunl0 up
ip addr add dev lo ${VIP}/32
# And then the equivalent for v6

And all was well and good in the kingdom.  But now we're getting ready to
turn up our IPv6-only internal cluster, and so we're forced to push forward
on things like v4-in-v6 tunneling (currently unsupported by IPVS, but we've
got a patch set that we'll put up when we have a working end-to-end-test).
Predictably, our magic script fell apart and we had to look into how the
sausage was made.

So, before I go off and write some terrible xfrm decapsulate-any module, is
there a "right way" to do this with stock linux?

Thanks,
Alex
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html