netdev - Re: [PATCH net-next] mpls: allow TTL propagation to/from IP packets to be configured

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3d871254-5f00-0807-d716-2f9028bcfef4@brocade.com>
Date:   Tue, 31 Jan 2017 12:00:36 +0000
From:   Robert Shearman <rshearma@...cade.com>
To:     David Ahern <dsa@...ulusnetworks.com>, <davem@...emloft.net>
CC:     <netdev@...r.kernel.org>, roopa <roopa@...ulusnetworks.com>,
        <ebiederm@...ssion.com>
Subject: Re: [PATCH net-next] mpls: allow TTL propagation to/from IP packets
 to be configured

On 31/01/17 00:41, David Ahern wrote:
> On 1/30/17 1:36 PM, Robert Shearman wrote:
>> It is sometimes desirable to present an MPLS transport network as a
>> single hop to traffic transiting it because it prevents confusion when
>> diagnosing failures. An example of where confusion can be generated is
>> when addresses used in the provider network overlap with addresses in
>> the overlay network and the addresses get exposed through ICMP errors
>> generated as packets transit the provider network.
>>
>> Therefore, provide the ability to control whether the TTL value from
>> an MPLS packet is propagated to an IPv4/IPv6 packet when the last
>> label is popped through the addition of a new per-namespace sysctl:
>> "net.mpls.ip_ttl_propagate" which defaults to enabled.
>>
>> Use the same sysctl to control whether the TTL is propagated from IP
>> packets into the MPLS header. If the TTL isn't propagated then a
>> default TTL value is used which can be configured via a new sysctl:
>> "net.mpls.default_ttl".
>>
>> Signed-off-by: Robert Shearman <rshearma@...cade.com>
>> ---
>>  Documentation/networking/mpls-sysctl.txt | 19 +++++++++
>>  include/net/netns/mpls.h                 |  3 ++
>>  net/mpls/af_mpls.c                       | 70 ++++++++++++++++++++++++--------
>>  net/mpls/mpls_iptunnel.c                 | 12 +++++-
>>  4 files changed, 85 insertions(+), 19 deletions(-)
>>
>> diff --git a/Documentation/networking/mpls-sysctl.txt b/Documentation/networking/mpls-sysctl.txt
>> index 15d8d16934fd..b8f0725ff09e 100644
>> --- a/Documentation/networking/mpls-sysctl.txt
>> +++ b/Documentation/networking/mpls-sysctl.txt
>> @@ -19,6 +19,25 @@ platform_labels - INTEGER
>>  	Possible values: 0 - 1048575
>>  	Default: 0
>>
>> +ip_ttl_propagate - BOOL
>> +	Control whether TTL is propagated from the IPv4/IPv6 header to
>> +	the MPLS header on imposing labels and propagated from the
>> +	MPLS header to the IPv4/IPv6 header on popping the last label.
>> +
>> +	If disabled, the MPLS transport network will appear as a
>> +	single hop to transit traffic.
>> +
>> +	0 - disabled
>> +	1 - enabled (default)
>> +
>
> It seems like you are going after RFC 3443 with this change. Can you add comment to that effect? i.e.,  ip_ttl_propagate enabled is the Uniform Model and ip_ttl_propagate disabled is the Short Pipe Model.
>

Good idea, will add it in the appropriate place depending on the chosen API.

Thanks,
Rob