netdev - Re: [PATCH v2 net] mpls: allow routes on ip6gre devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181003160731.byhrdymceyfq5mhs@netronome.com>
Date:   Wed, 3 Oct 2018 18:07:33 +0200
From:   Simon Horman <simon.horman@...ronome.com>
To:     Saif Hasan <has@...com>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Calvin Owens <calvinowens@...com>,
        Saif Hasan <saifhhasan@...il.com>
Subject: Re: [PATCH v2 net] mpls: allow routes on ip6gre devices

On Fri, Sep 21, 2018 at 02:30:05PM -0700, Saif Hasan wrote:
> Summary:
> 
> This appears to be necessary and sufficient change to enable `MPLS` on
> `ip6gre` tunnels (RFC4023).
> 
> This diff allows IP6GRE devices to be recognized by MPLS kernel module
> and hence user can configure interface to accept packets with mpls
> headers as well setup mpls routes on them.
> 
> Test Plan:
> 
> Test plan consists of multiple containers connected via GRE-V6 tunnel.
> Then carrying out testing steps as below.
> 
> - Carry out necessary sysctl settings on all containers
> 
> ```
> sysctl -w net.mpls.platform_labels=65536
> sysctl -w net.mpls.ip_ttl_propagate=1
> sysctl -w net.mpls.conf.lo.input=1
> ```
> 
> - Establish IP6GRE tunnels
> 
> ```
> ip -6 tunnel add name if_1_2_1 mode ip6gre \
>   local 2401:db00:21:6048:feed:0::1 \
>   remote 2401:db00:21:6048:feed:0::2 key 1
> ip link set dev if_1_2_1 up
> sysctl -w net.mpls.conf.if_1_2_1.input=1
> ip -4 addr add 169.254.0.2/31 dev if_1_2_1 scope link
> 
> ip -6 tunnel add name if_1_3_1 mode ip6gre \
>   local 2401:db00:21:6048:feed:0::1 \
>   remote 2401:db00:21:6048:feed:0::3 key 1
> ip link set dev if_1_3_1 up
> sysctl -w net.mpls.conf.if_1_3_1.input=1
> ip -4 addr add 169.254.0.4/31 dev if_1_3_1 scope link
> ```
> 
> - Install MPLS encap rules on node-1 towards node-2
> 
> ```
> ip route add 192.168.0.11/32 nexthop encap mpls 32/64 \
>   via inet 169.254.0.3 dev if_1_2_1
> ```
> 
> - Install MPLS forwarding rules on node-2 and node-3
> ```
> // node2
> ip -f mpls route add 32 via inet 169.254.0.7 dev if_2_4_1
> 
> // node3
> ip -f mpls route add 64 via inet 169.254.0.12 dev if_4_3_1
> ```
> 
> - Ping 192.168.0.11 (node4) from 192.168.0.1 (node1) (where routing
>   towards 192.168.0.1 is via IP route directly towards node1 from node4)
> ```
> ping 192.168.0.11
> ```
> 
> - tcpdump on interface to capture ping packets wrapped within MPLS
>   header which inturn wrapped within IP6GRE header
> 
> ```
> 16:43:41.121073 IP6
>   2401:db00:21:6048:feed::1 > 2401:db00:21:6048:feed::2:
>   DSTOPT GREv0, key=0x1, length 100:
>   MPLS (label 32, exp 0, ttl 255) (label 64, exp 0, [S], ttl 255)
>   IP 192.168.0.1 > 192.168.0.11:
>   ICMP echo request, id 1208, seq 45, length 64
> 
> 0x0000:  6000 2cdb 006c 3c3f 2401 db00 0021 6048  `.,..l<?$....!`H
> 0x0010:  feed 0000 0000 0001 2401 db00 0021 6048  ........$....!`H
> 0x0020:  feed 0000 0000 0002 2f00 0401 0401 0100  ......../.......
> 0x0030:  2000 8847 0000 0001 0002 00ff 0004 01ff  ...G............
> 0x0040:  4500 0054 3280 4000 ff01 c7cb c0a8 0001  E..T2.@.........
> 0x0050:  c0a8 000b 0800 a8d7 04b8 002d 2d3c a05b  ...........--<.[
> 0x0060:  0000 0000 bcd8 0100 0000 0000 1011 1213  ................
> 0x0070:  1415 1617 1819 1a1b 1c1d 1e1f 2021 2223  .............!"#
> 0x0080:  2425 2627 2829 2a2b 2c2d 2e2f 3031 3233  $%&'()*+,-./0123
> 0x0090:  3435 3637                                4567
> ```
> 
> Signed-off-by: Saif Hasan <has@...com>

This appears to be consistent with work I did to enable
MPLS over SIT, IPIP and (IPv4) IPGRE.

I do not recall why I did not enable IP6GRE at the time,
it may well have been a oversight.

Reviewed-by: Simon Horman <simon.horman@...ronome.com>

> ---
>  net/mpls/af_mpls.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
> index 7a4de6d618b1..8fbe6cdbe255 100644
> --- a/net/mpls/af_mpls.c
> +++ b/net/mpls/af_mpls.c
> @@ -1533,10 +1533,14 @@ static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
>  	unsigned int flags;
> 
>  	if (event == NETDEV_REGISTER) {
> -		/* For now just support Ethernet, IPGRE, SIT and IPIP devices */
> +
> +		/* For now just support Ethernet, IPGRE, IP6GRE, SIT and
> +		 * IPIP devices
> +		 */
>  		if (dev->type == ARPHRD_ETHER ||
>  		    dev->type == ARPHRD_LOOPBACK ||
>  		    dev->type == ARPHRD_IPGRE ||
> +		    dev->type == ARPHRD_IP6GRE ||
>  		    dev->type == ARPHRD_SIT ||
>  		    dev->type == ARPHRD_TUNNEL) {
>  			mdev = mpls_add_dev(dev);
> --
> 2.13.5
>