From: Matthias Schiffer <mschiffer@universe-factory.net>
To: davem@davemloft.net, jbenc@redhat.com,
hannes@stressinduktion.org, pshelar@ovn.org, aduyck@mirantis.com,
roopa@cumulusnetworks.com
Cc: netdev@vger.kernel.org, dev@openvswitch.org,
linux-kernel@vger.kernel.org
Subject: [PATCH net-next v3 4/6] vxlan: check valid combinations of address scopes
Date: Mon, 19 Jun 2017 10:03:58 +0200 [thread overview]
Message-ID: <d805d1b379ccd409281ec357a3c131dfdb8a7f16.1497825555.git.mschiffer@universe-factory.net> (raw)
In-Reply-To: <cover.1497825555.git.mschiffer@universe-factory.net>
In-Reply-To: <cover.1497825555.git.mschiffer@universe-factory.net>
* Multicast addresses are never valid as local address
* Link-local IPv6 unicast addresses may only be used as remote when the
local address is link-local as well
* Don't allow link-local IPv6 local/remote addresses without interface
We also store in the flags field if link-local addresses are used for the
follow-up patches that actually make VXLAN over link-local IPv6 work.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
---
Notes:
v2: was "vxlan: don't allow link-local IPv6 local/remote addresses without
interface" before. v2 does a lot more checks and adds the
VXLAN_F_IPV6_LINKLOCAL flag.
v3: remove kernel log messages
drivers/net/vxlan.c | 29 +++++++++++++++++++++++++++++
include/net/vxlan.h | 2 ++
2 files changed, 31 insertions(+)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 00680cc597ac..d6d57317cbd5 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2907,11 +2907,35 @@ static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf,
if (conf->saddr.sa.sa_family != conf->remote_ip.sa.sa_family)
return -EINVAL;
+ if (vxlan_addr_multicast(&conf->saddr))
+ return -EINVAL;
+
if (conf->saddr.sa.sa_family == AF_INET6) {
if (!IS_ENABLED(CONFIG_IPV6))
return -EPFNOSUPPORT;
use_ipv6 = true;
conf->flags |= VXLAN_F_IPV6;
+
+ if (!(conf->flags & VXLAN_F_COLLECT_METADATA)) {
+ int local_type =
+ ipv6_addr_type(&conf->saddr.sin6.sin6_addr);
+ int remote_type =
+ ipv6_addr_type(&conf->remote_ip.sin6.sin6_addr);
+
+ if (local_type & IPV6_ADDR_LINKLOCAL) {
+ if (!(remote_type & IPV6_ADDR_LINKLOCAL) &&
+ (remote_type != IPV6_ADDR_ANY))
+ return -EINVAL;
+
+ conf->flags |= VXLAN_F_IPV6_LINKLOCAL;
+ } else {
+ if (remote_type ==
+ (IPV6_ADDR_UNICAST | IPV6_ADDR_LINKLOCAL))
+ return -EINVAL;
+
+ conf->flags &= ~VXLAN_F_IPV6_LINKLOCAL;
+ }
+ }
}
if (conf->label && !use_ipv6)
@@ -2937,6 +2961,11 @@ static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf,
if (vxlan_addr_multicast(&conf->remote_ip))
return -EINVAL;
+#if IS_ENABLED(CONFIG_IPV6)
+ if (conf->flags & VXLAN_F_IPV6_LINKLOCAL)
+ return -EINVAL;
+#endif
+
*lower = NULL;
}
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 479bb75789ea..b816a0a6686e 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -258,6 +258,7 @@ struct vxlan_dev {
#define VXLAN_F_REMCSUM_NOPARTIAL 0x1000
#define VXLAN_F_COLLECT_METADATA 0x2000
#define VXLAN_F_GPE 0x4000
+#define VXLAN_F_IPV6_LINKLOCAL 0x8000
/* Flags that are used in the receive path. These flags must match in
* order for a socket to be shareable
@@ -272,6 +273,7 @@ struct vxlan_dev {
/* Flags that can be set together with VXLAN_F_GPE. */
#define VXLAN_F_ALLOWED_GPE (VXLAN_F_GPE | \
VXLAN_F_IPV6 | \
+ VXLAN_F_IPV6_LINKLOCAL | \
VXLAN_F_UDP_ZERO_CSUM_TX | \
VXLAN_F_UDP_ZERO_CSUM6_TX | \
VXLAN_F_UDP_ZERO_CSUM6_RX | \
--
2.13.1
next prev parent reply other threads:[~2017-06-19 8:04 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-19 8:03 [PATCH net-next v3 0/6] vxlan: cleanup and IPv6 link-local support Matthias Schiffer
2017-06-19 8:03 ` [PATCH net-next v3 1/6] vxlan: refactor verification and application of configuration Matthias Schiffer
2017-06-19 8:03 ` Matthias Schiffer
2017-06-23 8:52 ` Jiri Benc
2017-06-23 8:52 ` Jiri Benc
2017-06-23 10:13 ` Matthias Schiffer
2017-06-23 10:13 ` Matthias Schiffer
2017-06-23 10:23 ` Johannes Berg
2017-06-23 10:23 ` Johannes Berg
2017-06-23 12:02 ` Matthias Schiffer
2017-06-23 12:02 ` Matthias Schiffer
2017-06-23 13:31 ` Johannes Berg
2017-06-23 13:31 ` Johannes Berg
2017-06-19 8:03 ` [PATCH net-next v3 2/6] vxlan: get rid of redundant vxlan_dev.flags Matthias Schiffer
2017-06-19 8:03 ` Matthias Schiffer
2017-06-19 8:03 ` [PATCH net-next v3 3/6] vxlan: improve validation of address family configuration Matthias Schiffer
2017-06-19 8:03 ` Matthias Schiffer [this message]
2017-06-19 8:03 ` [PATCH net-next v3 5/6] vxlan: fix snooping for link-local IPv6 addresses Matthias Schiffer
2017-06-19 8:04 ` [PATCH net-next v3 6/6] vxlan: allow multiple VXLANs with same VNI for IPv6 link-local addresses Matthias Schiffer
2017-06-20 17:37 ` [PATCH net-next v3 0/6] vxlan: cleanup and IPv6 link-local support David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d805d1b379ccd409281ec357a3c131dfdb8a7f16.1497825555.git.mschiffer@universe-factory.net \
--to=mschiffer@universe-factory.net \
--cc=aduyck@mirantis.com \
--cc=davem@davemloft.net \
--cc=dev@openvswitch.org \
--cc=hannes@stressinduktion.org \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pshelar@ovn.org \
--cc=roopa@cumulusnetworks.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.