netdev - Re: [**EXTERNAL**] Re: VRF with enslaved L3 enabled bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Jul 2018 01:43:42 +0000
From:   "D'Souza, Nelson" <ndsouza@...na.com>
To:     David Ahern <dsa@...ulusnetworks.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [**EXTERNAL**] Re: VRF with enslaved L3 enabled bridge

Hi David,

I copy and pasted the configs onto my device, but pings on test-vrf do not work in my setup. 
I'm essentially seeing the same issue as I reported before.

In this case, pings sent out on test-vrf (host ns) are received and replied to by the loopback interface (foo ns). Although the replies are seen at the test-vrf level, they are not locally delivered to the ping application.

Logs are as follows...

a) pings on test-vrf or br0 fail.

# ping -I test-vrf 172.16.2.2 -c1 -w1
PING 172.16.2.2 (172.16.2.2): 56 data bytes

--- 172.16.2.2 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss

b) tcpdump in the foo namespace, shows icmp echos/replies on veth2

# ip netns exec foo tcpdump -i veth2 icmp -c 2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on veth2, link-type EN10MB (Ethernet), capture size 262144 bytes
18:34:13.205210 IP 172.16.1.1 > 172.16.2.2: ICMP echo request, id 19513, seq 0, length 64
18:34:13.205253 IP 172.16.2.2 > 172.16.1.1: ICMP echo reply, id 19513, seq 0, length 64
2 packets captured
2 packets received by filter
0 packets dropped by kernel

c) tcpdump in the host namespace, shows icmp echos/replies on test-vrf, br0 and veth1:

# tcpdump -i test-vrf icmp -c 2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on test-vrf, link-type EN10MB (Ethernet), capture size 262144 bytes
18:34:13.204061 IP 172.16.1.1 > 172.16.2.2: ICMP echo request, id 19513, seq 0, length 64
18:34:13.205278 IP 172.16.2.2 > 172.16.1.1: ICMP echo reply, id 19513, seq 0, length 64
2 packets captured
2 packets received by filter
0 packets dropped by kernel

Thanks,
Nelson

On 7/23/18, 3:00 PM, "David Ahern" <dsa@...ulusnetworks.com> wrote:

    On 7/20/18 1:03 PM, D'Souza, Nelson wrote:
    > Setup is as follows:
    > 
    > ethUSB(ingress port) -> mgmtbr0 (bridge) -> mgmtvrf (vrf)
    
    
    
                             |  netns foo
     [ test-vrf ]            |
           |                 |
        [ br0 ] 172.16.1.1   |
           |                 |
       [ veth1 ] ============|======= [ veth2 ]      lo
                             |       172.16.1.2     172.16.2.2
                             |
    
    
    Copy and paste the following into your environment:
    
    ip netns add foo
    ip li add veth1 type veth peer name veth2
    ip li set veth2 netns foo
    
    ip -netns foo li set lo up
    ip -netns foo li set veth2 up
    ip -netns foo addr add 172.16.1.2/24 dev veth2
    
    
    ip li add test-vrf type vrf table 123
    ip li set test-vrf up
    ip ro add vrf test-vrf unreachable default
    
    ip li add  br0 type bridge
    ip li set veth1 master br0
    ip li set veth1 up
    ip li set br0 up
    ip addr add dev br0 172.16.1.1/24
    ip li set br0 master test-vrf
    
    ip -netns foo addr add 172.16.2.2/32 dev lo
    ip ro add vrf test-vrf 172.16.2.2/32 via 172.16.1.2
    
    Does ping work?
    # ping -I test-vrf 172.16.2.2
    ping: Warning: source address might be selected on device other than
    test-vrf.
    PING 172.16.2.2 (172.16.2.2) from 172.16.1.1 test-vrf: 56(84) bytes of data.
    64 bytes from 172.16.2.2: icmp_seq=1 ttl=64 time=0.228 ms
    64 bytes from 172.16.2.2: icmp_seq=2 ttl=64 time=0.263 ms
    
    and:
    # ping -I br0 172.16.2.2
    PING 172.16.2.2 (172.16.2.2) from 172.16.1.1 br0: 56(84) bytes of data.
    64 bytes from 172.16.2.2: icmp_seq=1 ttl=64 time=0.227 ms
    64 bytes from 172.16.2.2: icmp_seq=2 ttl=64 time=0.223 ms
    ^C
    --- 172.16.2.2 ping statistics ---
    2 packets transmitted, 2 received, 0% packet loss, time 1001ms
    rtt min/avg/max/mdev = 0.223/0.225/0.227/0.002 ms