netdev - [PATCH iproute2] ip: link_gre6.c: Support IP6_TNL_F_ALLOW_LOCAL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <bfa08c6a478b7c54e21955f8c4224543970eb16e.1519129489.git.petrm@mellanox.com>
Date:   Tue, 20 Feb 2018 13:28:17 +0100
From:   Petr Machata <petrm@...lanox.com>
To:     <netdev@...r.kernel.org>
Subject: [PATCH iproute2] ip: link_gre6.c: Support
 IP6_TNL_F_ALLOW_LOCAL_REMOTE flag

For IP-in-IP tunnels, one can specify the [no]allow-localremote command
when configuring a device. Under the hood, this flips the
IP6_TNL_F_ALLOW_LOCAL_REMOTE flag on the netdevice. However, ip6gretap
and ip6erspan devices, where the flag is also relevant, are not IP-in-IP
tunnels, and thus there's no way to configure the flag on these
netdevices. Therefore introduce the command to link_gre6 as well.

The original support was introduced in commit
21440d19d957 ("ip: link_ip6tnl.c/ip6tunnel.c: Support IP6_TNL_F_ALLOW_LOCAL_REMOTE flag")

Signed-off-by: Petr Machata <petrm@...lanox.com>
---
 ip/link_gre6.c        | 11 +++++++++++
 man/man8/ip-link.8.in | 14 ++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/ip/link_gre6.c b/ip/link_gre6.c
index 4045f65..4c05344 100644
--- a/ip/link_gre6.c
+++ b/ip/link_gre6.c
@@ -44,6 +44,7 @@ static void print_usage(FILE *f)
 		"                                  [ flowlabel FLOWLABEL ]\n"
 		"                                  [ dscp inherit ]\n"
 		"                                  [ fwmark MARK ]\n"
+		"                                  [ [no]allow-localremote ]\n"
 		"                                  [ dev PHYS_DEV ]\n"
 		"                                  [ noencap ]\n"
 		"                                  [ encap { fou | gue | none } ]\n"
@@ -348,6 +349,10 @@ get_failed:
 					invarg("invalid fwmark\n", *argv);
 				flags &= ~IP6_TNL_F_USE_ORIG_FWMARK;
 			}
+		} else if (strcmp(*argv, "allow-localremote") == 0) {
+			flags |= IP6_TNL_F_ALLOW_LOCAL_REMOTE;
+		} else if (strcmp(*argv, "noallow-localremote") == 0) {
+			flags &= ~IP6_TNL_F_ALLOW_LOCAL_REMOTE;
 		} else if (strcmp(*argv, "encaplimit") == 0) {
 			NEXT_ARG();
 			if (strcmp(*argv, "none") == 0) {
@@ -534,6 +539,12 @@ static void gre_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
 	if (oflags & GRE_CSUM)
 		print_bool(PRINT_ANY, "ocsum", "ocsum ", true);
 
+	if (flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE)
+		print_bool(PRINT_ANY,
+			   "ip6_tnl_f_allow_local_remote",
+			   "allow-localremote ",
+			   true);
+
 	if (flags & IP6_TNL_F_USE_ORIG_FWMARK) {
 		print_bool(PRINT_ANY,
 			   "ip6_tnl_f_use_orig_fwmark",
diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
index 481589e..5dee9fc 100644
--- a/man/man8/ip-link.8.in
+++ b/man/man8/ip-link.8.in
@@ -793,6 +793,8 @@ the following additional arguments are supported:
 ] [
 .BI "dscp inherit"
 ] [
+.BI "[no]allow-localremote"
+] [
 .BI dev " PHYS_DEV "
 ] [
 .RB external
@@ -857,6 +859,11 @@ flag is equivalent to the combination
 - specifies a fixed flowlabel.
 
 .sp
+.BI  [no]allow-localremote
+- specifies whether to allow remote endpoint to have an address configured on
+local host.
+
+.sp
 .BI  tclass " TCLASS"
 - specifies the traffic class field on
 tunneled packets, which can be specified as either a two-digit
@@ -927,6 +934,8 @@ the following additional arguments are supported:
 ] [
 .BR erspan_hwid " \fIhwid "
 ] [
+.BI "[no]allow-localremote"
+] [
 .RB external
 ]
 
@@ -965,6 +974,11 @@ traffic's source port and direction.
 is a 6-bit value for users to configure.
 
 .sp
+.BI  [no]allow-localremote
+- specifies whether to allow remote endpoint to have an address configured on
+local host.
+
+.sp
 .BR external
 - make this tunnel externally controlled (or not, which is the default).
 In the kernel, this is referred to as collect metadata mode.  This flag is
-- 
2.4.11