lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ed2ce6dfbe6261219cb61f4be3e1db04cc0c335e.camel@redhat.com> Date: Tue, 24 Oct 2023 11:53:00 +0200 From: Paolo Abeni <pabeni@...hat.com> To: Alce Lafranque <alce@...ranque.net>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, David Ahern <dsahern@...nel.org>, Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org Cc: Vincent Bernat <vincent@...nat.ch> Subject: Re: [PATCH net-next v6] vxlan: add support for flowlabel inherit On Sun, 2023-10-22 at 14:14 -0500, Alce Lafranque wrote: > By default, VXLAN encapsulation over IPv6 sets the flow label to 0, with > an option for a fixed value. This commits add the ability to inherit the > flow label from the inner packet, like for other tunnel implementations. > This enables devices using only L3 headers for ECMP to correctly balance > VXLAN-encapsulated IPv6 packets. > > ``` > $ ./ip/ip link add dummy1 type dummy > $ ./ip/ip addr add 2001:db8::2/64 dev dummy1 > $ ./ip/ip link set up dev dummy1 > $ ./ip/ip link add vxlan1 type vxlan id 100 flowlabel inherit remote 2001:db8::1 local 2001:db8::2 > $ ./ip/ip link set up dev vxlan1 > $ ./ip/ip addr add 2001:db8:1::2/64 dev vxlan1 > $ ./ip/ip link set arp off dev vxlan1 > $ ping -q 2001:db8:1::1 & > $ tshark -d udp.port==8472,vxlan -Vpni dummy1 -c1 > [...] > Internet Protocol Version 6, Src: 2001:db8::2, Dst: 2001:db8::1 > 0110 .... = Version: 6 > .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) > .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) > .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) > .... 1011 0001 1010 1111 1011 = Flow Label: 0xb1afb > [...] > Virtual eXtensible Local Area Network > Flags: 0x0800, VXLAN Network ID (VNI) > Group Policy ID: 0 > VXLAN Network Identifier (VNI): 100 > [...] > Internet Protocol Version 6, Src: 2001:db8:1::2, Dst: 2001:db8:1::1 > 0110 .... = Version: 6 > .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) > .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) > .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) > .... 1011 0001 1010 1111 1011 = Flow Label: 0xb1afb > ``` > > Signed-off-by: Alce Lafranque <alce@...ranque.net> > Co-developed-by: Vincent Bernat <vincent@...nat.ch> > Signed-off-by: Vincent Bernat <vincent@...nat.ch> > Reviewed-by: Ido Schimmel <idosch@...dia.com> > > --- > v6: > - Rebase patch > v5: https://lore.kernel.org/netdev/20231019180417.210523-1-alce@lafranque.net/ > - Rollback policy label to fixed by default > v4: https://lore.kernel.org/all/20231014132102.54051-1-alce@lafranque.net/ > - Fix tabs > v3: https://lore.kernel.org/all/20231014131320.51810-1-alce@lafranque.net/ > - Adopt policy label inherit by default > - Set policy to label fixed when flowlabel is set > - Rename IFLA_VXLAN_LABEL_BEHAVIOR to IFLA_VXLAN_LABEL_POLICY > v2: https://lore.kernel.org/all/20231007142624.739192-1-alce@lafranque.net/ > - Use an enum instead of flag to define label behavior > v1: https://lore.kernel.org/all/4444C5AE-FA5A-49A4-9700-7DD9D7916C0F.1@mail.lac-coloc.fr/ > --- > drivers/net/vxlan/vxlan_core.c | 23 ++++++++++++++++++++++- > include/net/ip_tunnels.h | 11 +++++++++++ > include/net/vxlan.h | 33 +++++++++++++++++---------------- > include/uapi/linux/if_link.h | 8 ++++++++ > 4 files changed, 58 insertions(+), 17 deletions(-) > > diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c > index 6f7d45e3cfa2..341fd5eee9e1 100644 > --- a/drivers/net/vxlan/vxlan_core.c > +++ b/drivers/net/vxlan/vxlan_core.c > @@ -2443,7 +2443,17 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, > udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX); > #if IS_ENABLED(CONFIG_IPV6) > local_ip = vxlan->cfg.saddr; > - label = vxlan->cfg.label; > + switch (vxlan->cfg.label_policy) { > + case VXLAN_LABEL_FIXED: > + label = vxlan->cfg.label; > + break; > + case VXLAN_LABEL_INHERIT: > + label = ip_tunnel_get_flowlabel(old_iph, skb); > + break; > + default: > + DEBUG_NET_WARN_ON_ONCE(1); > + goto drop; > + } > #endif > } else { > if (!info) { I'm sorry, this does not apply cleanly to net-next as this chunk conflicts with commit 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup"), please rebase and re-post, thanks! Paolo
Powered by blists - more mailing lists