| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20240120124418.26117-1-alce@lafranque.net>
Date: Sat, 20 Jan 2024 06:44:18 -0600
From: Alce Lafranque <alce@...ranque.net>
To: netdev@...r.kernel.org,
stephen@...workplumber.org
Cc: Alce Lafranque <alce@...ranque.net>,
Vincent Bernat <vincent@...nat.ch>
Subject: [PATCH iproute2] vxlan: add support for flowlab inherit
By default, VXLAN encapsulation over IPv6 sets the flow label to 0, with
an option for a fixed value. This commits add the ability to inherit the
flow label from the inner packet, like for other tunnel implementations.
This enables devices using only L3 headers for ECMP to correctly balance
VXLAN-encapsulated IPv6 packets.
In relation to the commit "c6e9dba3be5e" ('vxlan: add support for
flowlabel inherit)
```
$ ./ip/ip link add dummy1 type dummy
$ ./ip/ip addr add 2001:db8::2/64 dev dummy1
$ ./ip/ip link set up dev dummy1
$ ./ip/ip link add vxlan1 type vxlan id 100 flowlabel inherit remote 2001:db8::1 local 2001:db8::2
$ ./ip/ip link set up dev vxlan1
$ ./ip/ip addr add 2001:db8:1::2/64 dev vxlan1
$ ./ip/ip link set arp off dev vxlan1
$ ping -q 2001:db8:1::1 &
$ tshark -d udp.port==8472,vxlan -Vpni dummy1 -c1
[...]
Internet Protocol Version 6, Src: 2001:db8::2, Dst: 2001:db8::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... 1011 0001 1010 1111 1011 = Flow Label: 0xb1afb
[...]
Virtual eXtensible Local Area Network
Flags: 0x0800, VXLAN Network ID (VNI)
Group Policy ID: 0
VXLAN Network Identifier (VNI): 100
[...]
Internet Protocol Version 6, Src: 2001:db8:1::2, Dst: 2001:db8:1::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... 1011 0001 1010 1111 1011 = Flow Label: 0xb1afb
```
```
$ ./ip/ip -d l l vxlan1
8: vxlan1: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/ether 36:2c:83:91:53:9e brd ff:ff:ff:ff:ff:ff promiscuity 0 allmulti 0 minmtu 68 maxmtu 65535
vxlan id 100 remote 2001:db8::1 local 2001:db8::2 srcport 0 0 dstport 8472 ttl auto flowlabel inherit ageing 300 [...]
```
```
$ ./ip/ip link set vxlan1 type vxlan flowlabel 10
$ ./ip/ip -d l l vxlan1
8: vxlan1: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/ether 36:2c:83:91:53:9e brd ff:ff:ff:ff:ff:ff promiscuity 0 allmulti 0 minmtu 68 maxmtu 65535
vxlan id 100 remote 2001:db8::1 local 2001:db8::2 srcport 0 0 dstport 8472 ttl auto flowlabel 0xa ageing 300 [...]
```
Signed-off-by: Alce Lafranque <alce@...ranque.net>
Co-developed-by: Vincent Bernat <vincent@...nat.ch>
Signed-off-by: Vincent Bernat <vincent@...nat.ch>
---
ip/iplink_vxlan.c | 41 ++++++++++++++++++++++++++++++-----------
1 file changed, 30 insertions(+), 11 deletions(-)
diff --git a/ip/iplink_vxlan.c b/ip/iplink_vxlan.c
index 7781d60b..0b72a545 100644
--- a/ip/iplink_vxlan.c
+++ b/ip/iplink_vxlan.c
@@ -72,7 +72,7 @@ static void print_explain(FILE *f)
" TOS := { NUMBER | inherit }\n"
" TTL := { 1..255 | auto | inherit }\n"
" DF := { unset | set | inherit }\n"
- " LABEL := 0-1048575\n"
+ " LABEL := { 0-1048575 | inherit }\n"
);
}
@@ -214,10 +214,16 @@ static int vxlan_parse_opt(struct link_util *lu, int argc, char **argv,
NEXT_ARG();
check_duparg(&attrs, IFLA_VXLAN_LABEL, "flowlabel",
*argv);
- if (get_u32(&uval, *argv, 0) ||
- (uval & ~LABEL_MAX_MASK))
- invarg("invalid flowlabel", *argv);
- addattr32(n, 1024, IFLA_VXLAN_LABEL, htonl(uval));
+ if (strcmp(*argv, "inherit") == 0) {
+ addattr32(n, 1024, IFLA_VXLAN_LABEL_POLICY, VXLAN_LABEL_INHERIT);
+ } else {
+ if (get_u32(&uval, *argv, 0) ||
+ (uval & ~LABEL_MAX_MASK))
+ invarg("invalid flowlabel", *argv);
+ addattr32(n, 1024, IFLA_VXLAN_LABEL_POLICY, VXLAN_LABEL_FIXED);
+ addattr32(n, 1024, IFLA_VXLAN_LABEL,
+ htonl(uval));
+ }
} else if (!matches(*argv, "ageing")) {
__u32 age;
@@ -580,12 +586,25 @@ static void vxlan_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
print_string(PRINT_ANY, "df", "df %s ", "inherit");
}
- if (tb[IFLA_VXLAN_LABEL]) {
- __u32 label = rta_getattr_u32(tb[IFLA_VXLAN_LABEL]);
-
- if (label)
- print_0xhex(PRINT_ANY, "label",
- "flowlabel %#llx ", ntohl(label));
+ enum ifla_vxlan_label_policy policy = VXLAN_LABEL_FIXED;
+ if (tb[IFLA_VXLAN_LABEL_POLICY]) {
+ policy = rta_getattr_u32(tb[IFLA_VXLAN_LABEL_POLICY]);
+ }
+ switch (policy) {
+ case VXLAN_LABEL_FIXED:
+ if (tb[IFLA_VXLAN_LABEL]) {
+ __u32 label = rta_getattr_u32(tb[IFLA_VXLAN_LABEL]);
+
+ if (label)
+ print_0xhex(PRINT_ANY, "label",
+ "flowlabel %#llx ", ntohl(label));
+ }
+ break;
+ case VXLAN_LABEL_INHERIT:
+ print_string(PRINT_FP, NULL, "flowlabel %s ", "inherit");
+ break;
+ default:
+ break;
}
if (tb[IFLA_VXLAN_AGEING]) {
--
2.39.2
Powered by blists - more mailing lists