netdev - Re: [PATCH iproute2] vxlan: add support for flowlab inherit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 22 Jan 2024 17:41:57 -0700
From: David Ahern <dsahern@...il.com>
To: Ido Schimmel <idosch@...sch.org>, Alce Lafranque <alce@...ranque.net>
Cc: netdev@...r.kernel.org, stephen@...workplumber.org,
 Vincent Bernat <vincent@...nat.ch>
Subject: Re: [PATCH iproute2] vxlan: add support for flowlab inherit

On 1/22/24 5:24 AM, Ido Schimmel wrote:
> s/flowlab/flowlabel/ in subject
> 
> My understanding is that new features should be targeted at
> iproute2-next. See the README.
> 
> On Sat, Jan 20, 2024 at 06:44:18AM -0600, Alce Lafranque wrote:
>> @@ -214,10 +214,16 @@ static int vxlan_parse_opt(struct link_util *lu, int argc, char **argv,
>>  			NEXT_ARG();
>>  			check_duparg(&attrs, IFLA_VXLAN_LABEL, "flowlabel",
>>  				     *argv);
>> -			if (get_u32(&uval, *argv, 0) ||
>> -			    (uval & ~LABEL_MAX_MASK))
>> -				invarg("invalid flowlabel", *argv);
>> -			addattr32(n, 1024, IFLA_VXLAN_LABEL, htonl(uval));
>> +			if (strcmp(*argv, "inherit") == 0) {
>> +				addattr32(n, 1024, IFLA_VXLAN_LABEL_POLICY, VXLAN_LABEL_INHERIT);
>> +			} else {
>> +				if (get_u32(&uval, *argv, 0) ||
>> +				    (uval & ~LABEL_MAX_MASK))
>> +					invarg("invalid flowlabel", *argv);
>> +				addattr32(n, 1024, IFLA_VXLAN_LABEL_POLICY, VXLAN_LABEL_FIXED);
> 
> I think I mentioned this during the review of the kernel patch, but the
> current approach relies on old kernels ignoring the
> 'IFLA_VXLAN_LABEL_POLICY' attribute which is not nice. 

Common theme with vxlan attributes :-(


> My personal
> preference would be to add a new keyword for the new attribute:
> 
> # ip link set dev vx0 type vxlan flowlabel_policy inherit
> # ip link set dev vx0 type vxlan flowlabel_policy fixed flowlabel 10
> 
> But let's see what David thinks.
> 


A new keyword for the new attribute seems like the most robust.

That said, inherit is already used in several ip commands for dscp, ttl
and flowlabel for example; I do not see a separate keyword - e.g.,
ip6tunnel.c.