netdev - [PATCH iproute2-next 4/7] bridge: mdb: Add destination VNI support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230321130127.264822-5-idosch@nvidia.com>
Date:   Tue, 21 Mar 2023 15:01:24 +0200
From:   Ido Schimmel <idosch@...dia.com>
To:     netdev@...r.kernel.org
Cc:     dsahern@...il.com, stephen@...workplumber.org, razor@...ckwall.org,
        petrm@...dia.com, mlxsw@...dia.com,
        Ido Schimmel <idosch@...dia.com>
Subject: [PATCH iproute2-next 4/7] bridge: mdb: Add destination VNI support

In a similar fashion to VXLAN FDB entries, allow user space to program
and view the destination VNI of VXLAN MDB entries. Specifically, add
support for the 'MDBE_ATTR_VNI' and 'MDBA_MDB_EATTR_VNI' attributes in
request and response messages, respectively.

This is useful when ingress replication (IR) is used and the destination
VXLAN tunnel endpoint (VTEP) is not a member of the source broadcast
domain (BD). In this case, the ingress VTEP should transmit the packet
using the VNI of the Supplementary Broadcast Domain (SBD) in which all
the VTEPs are member of [1].

Example:

 # bridge mdb add dev vxlan0 port vxlan0 grp 239.1.1.1 permanent dst 198.51.100.1 vni 1111

 $ bridge -d -s mdb show
 dev vxlan0 port vxlan0 grp 239.1.1.1 permanent filter_mode exclude proto static dst 198.51.100.1 vni 1111    0.00

 $ bridge -d -s -j -p mdb show
 [ {
         "mdb": [ {
                 "index": 15,
                 "dev": "vxlan0",
                 "port": "vxlan0",
                 "grp": "239.1.1.1",
                 "state": "permanent",
                 "filter_mode": "exclude",
                 "protocol": "static",
                 "flags": [ ],
                 "dst": "198.51.100.1",
                 "vni": 1111,
                 "timer": "   0.00"
             } ],
         "router": {}
     } ]

[1] https://datatracker.ietf.org/doc/html/draft-ietf-bess-evpn-irb-mcast#section-3.2.2

Signed-off-by: Ido Schimmel <idosch@...dia.com>
---
 bridge/mdb.c      | 34 ++++++++++++++++++++++++++++++++--
 man/man8/bridge.8 | 10 +++++++++-
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/bridge/mdb.c b/bridge/mdb.c
index 893488211911..2174eeb6e933 100644
--- a/bridge/mdb.c
+++ b/bridge/mdb.c
@@ -34,7 +34,7 @@ static void usage(void)
 	fprintf(stderr,
 		"Usage: bridge mdb { add | del | replace } dev DEV port PORT grp GROUP [src SOURCE] [permanent | temp] [vid VID]\n"
 		"              [ filter_mode { include | exclude } ] [ source_list SOURCE_LIST ] [ proto PROTO ] [ dst IPADDR ]\n"
-		"              [ dst_port DST_PORT ]\n"
+		"              [ dst_port DST_PORT ] [ vni VNI ]\n"
 		"       bridge mdb {show} [ dev DEV ] [ vid VID ]\n");
 	exit(-1);
 }
@@ -264,6 +264,10 @@ static void print_mdb_entry(FILE *f, int ifindex, const struct br_mdb_entry *e,
 		print_uint(PRINT_ANY, "dst_port", " dst_port %u",
 			   rta_getattr_u16(tb[MDBA_MDB_EATTR_DST_PORT]));
 
+	if (tb[MDBA_MDB_EATTR_VNI])
+		print_uint(PRINT_ANY, "vni", " vni %u",
+			   rta_getattr_u32(tb[MDBA_MDB_EATTR_VNI]));
+
 	if (show_stats && tb && tb[MDBA_MDB_EATTR_TIMER]) {
 		__u32 timer = rta_getattr_u32(tb[MDBA_MDB_EATTR_TIMER]);
 
@@ -636,6 +640,21 @@ static int mdb_parse_dst_port(struct nlmsghdr *n, int maxlen,
 	return 0;
 }
 
+static int mdb_parse_vni(struct nlmsghdr *n, int maxlen, const char *vni,
+			 int attr_type)
+{
+	unsigned long vni_num;
+	char *endptr;
+
+	vni_num = strtoul(vni, &endptr, 0);
+	if ((endptr && *endptr) || vni_num == ULONG_MAX)
+		return -1;
+
+	addattr32(n, maxlen, attr_type, vni_num);
+
+	return 0;
+}
+
 static int mdb_modify(int cmd, int flags, int argc, char **argv)
 {
 	struct {
@@ -650,7 +669,7 @@ static int mdb_modify(int cmd, int flags, int argc, char **argv)
 	};
 	char *d = NULL, *p = NULL, *grp = NULL, *src = NULL, *mode = NULL;
 	char *src_list = NULL, *proto = NULL, *dst = NULL;
-	char *dst_port = NULL;
+	char *dst_port = NULL, *vni = NULL;
 	struct br_mdb_entry entry = {};
 	bool set_attrs = false;
 	short vid = 0;
@@ -697,6 +716,10 @@ static int mdb_modify(int cmd, int flags, int argc, char **argv)
 			NEXT_ARG();
 			dst_port = *argv;
 			set_attrs = true;
+		} else if (strcmp(*argv, "vni") == 0) {
+			NEXT_ARG();
+			vni = *argv;
+			set_attrs = true;
 		} else {
 			if (matches(*argv, "help") == 0)
 				usage();
@@ -762,6 +785,13 @@ static int mdb_modify(int cmd, int flags, int argc, char **argv)
 			return -1;
 		}
 
+		if (vni && mdb_parse_vni(&req.n, sizeof(req), vni,
+					 MDBE_ATTR_VNI)) {
+			fprintf(stderr, "Invalid destination VNI \"%s\"\n",
+				vni);
+			return -1;
+		}
+
 		addattr_nest_end(&req.n, nest);
 	}
 
diff --git a/man/man8/bridge.8 b/man/man8/bridge.8
index 9385aba0ee68..f39d434fa20a 100644
--- a/man/man8/bridge.8
+++ b/man/man8/bridge.8
@@ -149,7 +149,9 @@ bridge \- show / manipulate bridge addresses and devices
 .B dst
 .IR IPADDR " ] [ "
 .B dst_port
-.IR DST_PORT " ]
+.IR DST_PORT " ] [ "
+.B vni
+.IR VNI " ]
 
 .ti -8
 .BR "bridge mdb show" " [ "
@@ -990,6 +992,12 @@ the UDP destination port number to use to connect to the remote VXLAN tunnel
 endpoint. If omitted, the value specified at VXLAN device creation will be
 used.
 
+.TP
+.BI vni " VNI"
+the VXLAN VNI Network Identifier to use to connect to the remote VXLAN tunnel
+endpoint. If omitted, the value specified at VXLAN device creation will be used
+or the source VNI when the VXLAN device is in external mode.
+
 .in -8
 .SS bridge mdb delete - delete a multicast group database entry
 This command removes an existing mdb entry.
-- 
2.37.3