netdev - Re: [PATCH iproute2-next v2] ip-link: add support for nolocalbypass in vxlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZGSlU4bW+AmIr2MD@renaissance-vector>
Date: Wed, 17 May 2023 11:58:43 +0200
From: Andrea Claudi <aclaudi@...hat.com>
To: Vladimir Nikishkin <vladimir@...ishkin.pw>
Cc: netdev@...r.kernel.org, davem@...emloft.net, edumazet@...gle.com,
	kuba@...nel.org, pabeni@...hat.com,
	eng.alaamohamedsoliman.am@...il.com, gnault@...hat.com,
	razor@...ckwall.org, idosch@...dia.com, liuhangbin@...il.com,
	eyal.birger@...il.com, jtoppins@...hat.com
Subject: Re: [PATCH iproute2-next v2] ip-link: add support for nolocalbypass
 in vxlan

On Tue, May 16, 2023 at 10:04:57PM +0800, Vladimir Nikishkin wrote:
> Add userspace support for the [no]localbypass vxlan netlink
> attribute. With localbypass on (default), the vxlan driver processes
> the packets destined to the local machine by itself, bypassing the
> nework stack. With nolocalbypass the packets are always forwarded to
> the userspace network stack, so usepspace programs, such as tcpdump
> have a chance to process them.
> 
> Signed-off-by: Vladimir Nikishkin <vladimir@...ishkin.pw>
> ---
> v2: this patch matches commit 69474a8a5837be63f13c6f60a7d622b98ed5c539
> in the main tree.
> 
>  ip/iplink_vxlan.c     | 19 +++++++++++++++++++
>  man/man8/ip-link.8.in | 10 ++++++++++
>  2 files changed, 29 insertions(+)
> 
> diff --git a/ip/iplink_vxlan.c b/ip/iplink_vxlan.c
> index c7e0e1c4..98fbc65c 100644
> --- a/ip/iplink_vxlan.c
> +++ b/ip/iplink_vxlan.c
> @@ -45,6 +45,7 @@ static void print_explain(FILE *f)
>  		"		[ [no]remcsumtx ] [ [no]remcsumrx ]\n"
>  		"		[ [no]external ] [ gbp ] [ gpe ]\n"
>  		"		[ [no]vnifilter ]\n"
> +		"		[ [no]localbypass ]\n"
>  		"\n"
>  		"Where:	VNI	:= 0-16777215\n"
>  		"	ADDR	:= { IP_ADDRESS | any }\n"
> @@ -276,6 +277,12 @@ static int vxlan_parse_opt(struct link_util *lu, int argc, char **argv,
>  		} else if (!matches(*argv, "noudpcsum")) {
>  			check_duparg(&attrs, IFLA_VXLAN_UDP_CSUM, *argv, *argv);
>  			addattr8(n, 1024, IFLA_VXLAN_UDP_CSUM, 0);
> +		} else if (0 == strcmp(*argv, "localbypass")) {
> +			check_duparg(&attrs, IFLA_VXLAN_LOCALBYPASS, *argv, *argv);
> +			addattr8(n, 1024, IFLA_VXLAN_LOCALBYPASS, 1);
> +		} else if (0 == strcmp(*argv, "nolocalbypass")) {
> +			check_duparg(&attrs, IFLA_VXLAN_LOCALBYPASS, *argv, *argv);
> +			addattr8(n, 1024, IFLA_VXLAN_LOCALBYPASS, 0);
>  		} else if (!matches(*argv, "udp6zerocsumtx")) {
>  			check_duparg(&attrs, IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
>  				     *argv, *argv);
> @@ -613,6 +620,18 @@ static void vxlan_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>  		}
>  	}
>  
> +	if (tb[IFLA_VXLAN_LOCALBYPASS]) {
> +		__u8 localbypass = rta_getattr_u8(tb[IFLA_VXLAN_LOCALBYPASS]);
> +
> +		if (is_json_context()) {
> +			print_bool(PRINT_ANY, "localbypass", NULL, localbypass);
> +		} else {
> +			if (!localbypass)
> +				fputs("no", f);
> +			fputs("localbypass ", f);
> +		}

Please use print_* functions for non-json output, too.

Also, you don't need to use is_json_context() here, you can simply use
PRINT_JSON to ensure that info is printed only for json output.

Something like this should work:

+		print_bool(PRINT_JSON, "localbypass", NULL, localbypass);
+		if (localbypass) {
+			print_string(PRINT_FP, NULL, "localbypass ", NULL);
+		} else {
+			print_string(PRINT_FP, NULL, "nolocalbypass ", NULL);
+		}

> +	}
> +
>  	if (tb[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]) {
>  		__u8 csum6 = rta_getattr_u8(tb[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]);
>  
> diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
> index bf3605a9..e53efc45 100644
> --- a/man/man8/ip-link.8.in
> +++ b/man/man8/ip-link.8.in
> @@ -630,6 +630,8 @@ the following additional arguments are supported:
>  ] [
>  .RB [ no ] udpcsum
>  ] [
> +.RB [ no ] localbypass
> +] [
>  .RB [ no ] udp6zerocsumtx
>  ] [
>  .RB [ no ] udp6zerocsumrx
> @@ -734,6 +736,14 @@ are entered into the VXLAN device forwarding database.
>  .RB [ no ] udpcsum
>  - specifies if UDP checksum is calculated for transmitted packets over IPv4.
>  
> +.sp
> +.RB [ no ] localbypass
> +- if fdb destination is local, with nolocalbypass set, forward packets
> +to the userspace network stack. If there is a userspace process
> +listening for these packets, it will have a chance to process them.
> +If localbypass is active (default), bypass the network stack and
> +inject the packet into the driver directly.
> +
>  .sp
>  .RB [ no ] udp6zerocsumtx
>  - skip UDP checksum calculation for transmitted packets over IPv6.
> -- 
> 2.35.8
> 
> --
> Fastmail.
> 
>