netdev - Re: Add `auto` VRF table ID option in iproute2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZrzVNV7Ap230Lx4h@shredder.mtl.com>
Date: Wed, 14 Aug 2024 19:03:01 +0300
From: Ido Schimmel <idosch@...sch.org>
To: Mike Waterman <mwaterman@...tr.com>
Cc: netdev@...r.kernel.org, stephen@...workplumber.org,
	Daniel Gröber <dxld@...kboxed.org>,
	dsahern@...il.com
Subject: Re: Add `auto` VRF table ID option in iproute2

On Wed, Aug 14, 2024 at 09:28:00AM -0400, Mike Waterman wrote:
> Hello,
> 
> Package: iproute2
> Version: 5.10.0-4
> 
> Feature request: Add an `auto` option for VRF table ID management like
> in Cumulus Linux. I believe it'd be the iproute2 package on Debian
> (11/12).

I checked with the Cumulus team and they do not have an "auto" option
for VRF in iproute2. It does exists in ifupdown2, but that is an
interface manager, unlike iproute2.

> 
> Example: Instead of specifying, say, 1001 for a table ID, we'd do the
> following with the `auto` option:
> 
> ```
> auto vrfexample
> iface vrfexample
>     vrf-table auto
> ```
> 
> Or:
> 
> ```
> ip link add vrfexample type vrf table auto
> ```

AFAICT in ifupdown2 they have a table that keeps track of allocate IDs
and they simply pick the next available one. Unlike ifupdown2, iproute2
does not have state and it will need to query this information from the
kernel which you can do yourself in a script before calling this
command.

Overall I don't really see the benefit in something like that in
iproute2 and I don't recall other iproute2 commands that work like that.

Also note that ifupdown2 reorders the FIB rules so that the l3mdev rule
is before the local rule. This is something that iproute2 does not (and
should not) do.

Adding David who might have a different opinion.

> 
> (I'm new to the list and this is my first request. I tried to be brief
> to respect time. Please ask any follow-ups as needed.)

It would be good to explain the motivation

> 
> Thanks!
> 
> Best,
> Mike Waterman
>