netdev - Re: [PATCH net-next] VXLAN: Allow L2 redirection with L3 switching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20130422.161036.274813188898687611.davem@davemloft.net>
Date:	Mon, 22 Apr 2013 16:10:36 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	dlstevens@...ibm.com
Cc:	shemminger@...tta.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] VXLAN: Allow L2 redirection with L3 switching

From: David L Stevens <dlstevens@...ibm.com>
Date: Fri, 19 Apr 2013 06:36:26 -0400

> 
> Allow L2 redirection when VXLAN L3 switching is enabled
> 
> This patch restricts L3 switching to destination MAC addresses that are
> marked as routers in order to allow virtual IP appliances that do L2
> redirection to function with VXLAN L3 switching enabled.
> 
> We use L3 switching on VXLAN networks to avoid extra hops when the nominal
> router for cross-subnet traffic for a VM is remote and the ultimate
> destination may be local, or closer to the local node. Currently, the
> destination IP address takes precedence over the MAC address in all cases.
> Some network appliances receive packets for a virtualized IP address and
> redirect by changing the destination MAC address (only) to be the final
> destination for packet processing. VXLAN tunnel endpoints with L3 switching
> enabled may then overwrite this destination MAC address based on the packet IP
> address, resulting in potential loops and, at least, breaking L2 redirections
> that travel through tunnel endpoints.
> 
> This patch limits L3 switching to the intended case where the original
> destination MAC address is a next-hop router and relies on the destination
> MAC address for all other cases, thus allowing L2 redirection and L3 switching
> to coexist peacefully.
> 
> Signed-Off-By: David L Stevens <dlstevens@...ibm.com>

Applied, thanks David.

Amerigo, I know this conflicts with your ipv6 work, but I'm not making
David wait while you sort out all of those ipv6 symbol export build
failures.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html