[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHgT=KcQb4ngBmhU82cc+XbW_2RvYfi0OwH5ROstkw9DD8G3mA@mail.gmail.com>
Date: Sat, 4 Jan 2020 00:56:41 -0500
From: Trev Larock <trev@...ock.ca>
To: David Ahern <dsahern@...il.com>
Cc: Trev Larock <trev@...ock.ca>, netdev@...r.kernel.org,
Ben Greear <greearb@...delatech.com>
Subject: Re: VRF + ip xfrm, egress ESP packet looping when qdisc configured
On Thu, Jan 2, 2020 at 11:44 PM David Ahern <dsahern@...il.com> wrote:
> Ben, cc-ed, has done some IPsec + VRF work.
>
> I have not done much wth xfrm + vrf. Can you re-create this with network
> namespaces? If so, send the commands and I will take a look when I can.
>
Thanks for responding David, under namespace the same behavior is seen.
Setup for host1 was fedora31 kernel 5.3.7-301.fc31.x86_64, host2 optional
host1 netns ns0 | host2
+---------------+ |
| vrf0 | |
+---------------+ |
| |
| |
+--------+ |
| enp0s8 | 192.168.56.116 --------------- 192.168.56.114
+--------+ |
|
ip netns add ns0
ip netns exec ns0 ip link set lo up
ip link set dev enp0s8 netns ns0
sysctl net.ipv4.tcp_l3mdev_accept=1
ip netns exec ns0 sysctl net.ipv4.tcp_l3mdev_accept=1
ip netns exec ns0 ip addr add 192.168.56.116/24 dev enp0s8
ip netns exec ns0 ip link set enp0s8 up
ip netns exec ns0 ip link add dev vrf0 type vrf table 300
ip netns exec ns0 ip link set dev vrf0 up
ip netns exec ns0 ip link set dev enp0s8 master vrf0
ip netns exec ns0 ip xfrm policy add src 192.168.56.116/32 dst
192.168.56.114/32 dir out priority 367231 ptype main tmpl src
192.168.56.116 dst 192.168.56.114 proto esp spi 0x1234567 reqid 1 mode
tunnel
ip netns exec ns0 ip xfrm state add src 192.168.56.116 dst
192.168.56.114 proto esp spi 0x1234567 reqid 1 mode tunnel aead
'rfc4106(gcm(aes))'
0x68db8eabd7f61557247f28f95e668f19855e086d02b21488fde4f5fcc9d42fcfbc9a2e35
128 sel src 192.168.56.116/32 dst 192.168.56.114/32
# With qdisc have the looping ESP packet in vrf0
ip netns exec ns0 tc qdisc add dev vrf0 root netem delay 0ms
# ping to trigger policy
ip netns exec ns0 ping -c 1 -w 1 -I vrf0 192.168.56.114
# monitor with tcpdump
ip netns exec ns0 tcpdump -i vrf0 host 192.168.56.114
Thanks
Trev
Powered by blists - more mailing lists