netdev - Re: Maximum MPLS labels on Linux network stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPWQB7FFwBFL9h7JoJMF4FuK7JXLrHfo5yg4aHJ4iczSdNU_bg@mail.gmail.com>
Date:   Wed, 3 May 2017 13:21:16 -0700
From:   Joe Stringer <joe@....org>
To:     David Ahern <dsahern@...il.com>
Cc:     Алексей Болдырев 
        <devel-net-ne-vlezay80@...dex.ru>, netdev <netdev@...r.kernel.org>
Subject: Re: Maximum MPLS labels on Linux network stack

On 3 May 2017 at 11:14, David Ahern <dsahern@...il.com> wrote:
> On 5/3/17 11:33 AM, Алексей Болдырев wrote:
>> I watched one forum, there is listed in the properties of one license for Cisco, it says:
>>
>> Layer 3 VPN • Multi-VRF CE (VRF-lite); requires IP Services Feature license
>> • MPLS VPN; requires Advanced IP Feature license
>> • 26 VRFs
>
> There is no direct limit on the number of VRFs the kernel allows you to
> create. There are indirect ones -- total memory in the system and limits
> such as /proc/sys/net/ipv6/route/max_size. By increasing the latter I
> have created 4k VRFs in a system.
>
>
>> • 8192 MPLS labels
>>
>> Especially interested in the figure 8192 MPLS Labels.
>
> 8192 labels added in one pass is absurd. There is no reason to support
> such a number. With the latest version of the MPLS stack in the kernel
> you can add up to 30 labels in a single route. If you want more you have
> to either recirculate the packet using routes or recompile the kernel
> and increase the memory limit and the number of labels limit.
>
>>
>> As I understand it, is it either a limit on the number of labels on the stack or the total number of labels?
>>
>> In Linux, for example, you can specify a common col- lection of labels through /proc/sys/net/mpls/platforms_labels
>
> that just allocates the size of an array which dictates the max label
> number for that namespace. The array needs to be converted to a hash
> table at some point.
>
>>
>> Also I would like to know if the openvswitch has a limit of 3 tags in the stack or the total number of MPLS labels that can send?
>>
>
> someone familiar with OVS needs to answer that.

That would be 3 tags in a stack. When we spoke to people involved in
the design and usage of MPLS in practice, we got the impression that
it's very rare for anyone to configure a setup where more than that is
used concurrently on a packet. If you believe the contrary, then I
imagine it's not hard to bump that limit.

There is no limit on which labels can be used from OVS, it's just a
number in an action attached to a flow.