* [RFC PATCH] Don't copy mark from encapsulated packet when routing VXLAN
@ 2019-09-30 6:27 Jethro Beekman
2019-10-01 15:30 ` Roopa Prabhu
0 siblings, 1 reply; 3+ messages in thread
From: Jethro Beekman @ 2019-09-30 6:27 UTC (permalink / raw)
To: David S. Miller, Petr Machata, Ido Schimmel, Stefano Brivio,
Roopa Prabhu, Litao jiao, netdev, linux-kernel
Cc: Jethro Beekman
[-- Attachment #1: Type: text/plain, Size: 1816 bytes --]
When using rule-based routing to send traffic via VXLAN, a routing
loop may occur. Say you have the following routing setup:
ip rule add from all fwmark 0x2/0x2 lookup 2
ip route add table 2 default via 10.244.2.0 dev vxlan1 onlink
The intention is to route packets with mark 2 through VXLAN, and
this works fine. However, the current vxlan code copies the mark
to the encapsulated packet. Immediately after egress on the VXLAN
interface, the encapsulated packet is routed, with no opportunity
to mangle the encapsulated packet. The mark is copied from the
inner packet to the outer packet, and the same routing rule and
table shown above will apply, resulting in ELOOP.
This patch simply doesn't copy the mark from the encapsulated packet.
I don't intend this code to land as is, but I want to start a
discussion on how to make separate routing of VXLAN inner and
encapsulated traffic easier.
Signed-off-by: Jethro Beekman <jethro@fortanix.com>
---
drivers/net/vxlan.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 3d9bcc9..f9ed1b7 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2236,7 +2236,6 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
memset(&fl4, 0, sizeof(fl4));
fl4.flowi4_oif = oif;
fl4.flowi4_tos = RT_TOS(tos);
- fl4.flowi4_mark = skb->mark;
fl4.flowi4_proto = IPPROTO_UDP;
fl4.daddr = daddr;
fl4.saddr = *saddr;
@@ -2294,7 +2293,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
fl6.daddr = *daddr;
fl6.saddr = *saddr;
fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
- fl6.flowi6_mark = skb->mark;
fl6.flowi6_proto = IPPROTO_UDP;
fl6.fl6_dport = dport;
fl6.fl6_sport = sport;
--
2.7.4
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4054 bytes --]
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [RFC PATCH] Don't copy mark from encapsulated packet when routing VXLAN
2019-09-30 6:27 [RFC PATCH] Don't copy mark from encapsulated packet when routing VXLAN Jethro Beekman
@ 2019-10-01 15:30 ` Roopa Prabhu
2019-10-01 15:34 ` Jethro Beekman
0 siblings, 1 reply; 3+ messages in thread
From: Roopa Prabhu @ 2019-10-01 15:30 UTC (permalink / raw)
To: Jethro Beekman
Cc: David S. Miller, Petr Machata, Ido Schimmel, Stefano Brivio,
Litao jiao, netdev, linux-kernel
On Sun, Sep 29, 2019 at 11:27 PM Jethro Beekman <jethro@fortanix.com> wrote:
>
> When using rule-based routing to send traffic via VXLAN, a routing
> loop may occur. Say you have the following routing setup:
>
> ip rule add from all fwmark 0x2/0x2 lookup 2
> ip route add table 2 default via 10.244.2.0 dev vxlan1 onlink
>
> The intention is to route packets with mark 2 through VXLAN, and
> this works fine. However, the current vxlan code copies the mark
> to the encapsulated packet. Immediately after egress on the VXLAN
> interface, the encapsulated packet is routed, with no opportunity
> to mangle the encapsulated packet. The mark is copied from the
> inner packet to the outer packet, and the same routing rule and
> table shown above will apply, resulting in ELOOP.
>
> This patch simply doesn't copy the mark from the encapsulated packet.
> I don't intend this code to land as is, but I want to start a
> discussion on how to make separate routing of VXLAN inner and
> encapsulated traffic easier.
yeah, i think the patch as is will break users who use mark to
influence the underlay route lookup.
When you say the mark is copied into the packet, what exactly are you
seeing and where is the copy happening ?
>
> Signed-off-by: Jethro Beekman <jethro@fortanix.com>
> ---
> drivers/net/vxlan.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
> index 3d9bcc9..f9ed1b7 100644
> --- a/drivers/net/vxlan.c
> +++ b/drivers/net/vxlan.c
> @@ -2236,7 +2236,6 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
> memset(&fl4, 0, sizeof(fl4));
> fl4.flowi4_oif = oif;
> fl4.flowi4_tos = RT_TOS(tos);
> - fl4.flowi4_mark = skb->mark;
> fl4.flowi4_proto = IPPROTO_UDP;
> fl4.daddr = daddr;
> fl4.saddr = *saddr;
> @@ -2294,7 +2293,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
> fl6.daddr = *daddr;
> fl6.saddr = *saddr;
> fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
> - fl6.flowi6_mark = skb->mark;
> fl6.flowi6_proto = IPPROTO_UDP;
> fl6.fl6_dport = dport;
> fl6.fl6_sport = sport;
> --
> 2.7.4
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RFC PATCH] Don't copy mark from encapsulated packet when routing VXLAN
2019-10-01 15:30 ` Roopa Prabhu
@ 2019-10-01 15:34 ` Jethro Beekman
0 siblings, 0 replies; 3+ messages in thread
From: Jethro Beekman @ 2019-10-01 15:34 UTC (permalink / raw)
To: Roopa Prabhu
Cc: David S. Miller, Petr Machata, Ido Schimmel, Stefano Brivio,
Litao jiao, netdev, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 2541 bytes --]
On 2019-10-01 17:30, Roopa Prabhu wrote:
> On Sun, Sep 29, 2019 at 11:27 PM Jethro Beekman <jethro@fortanix.com> wrote:
>>
>> When using rule-based routing to send traffic via VXLAN, a routing
>> loop may occur. Say you have the following routing setup:
>>
>> ip rule add from all fwmark 0x2/0x2 lookup 2
>> ip route add table 2 default via 10.244.2.0 dev vxlan1 onlink
>>
>> The intention is to route packets with mark 2 through VXLAN, and
>> this works fine. However, the current vxlan code copies the mark
>> to the encapsulated packet. Immediately after egress on the VXLAN
>> interface, the encapsulated packet is routed, with no opportunity
>> to mangle the encapsulated packet. The mark is copied from the
>> inner packet to the outer packet, and the same routing rule and
>> table shown above will apply, resulting in ELOOP.
>>
>> This patch simply doesn't copy the mark from the encapsulated packet.
>> I don't intend this code to land as is, but I want to start a
>> discussion on how to make separate routing of VXLAN inner and
>> encapsulated traffic easier.
>
> yeah, i think the patch as is will break users who use mark to
> influence the underlay route lookup.
> When you say the mark is copied into the packet, what exactly are you
> seeing and where is the copy happening ?
>
Maybe the mark isn't actually copied? At least it's used in the route lookup as shown in the patch.
--
Jethro Beekman | Fortanix
>
>
>>
>> Signed-off-by: Jethro Beekman <jethro@fortanix.com>
>> ---
>> drivers/net/vxlan.c | 2 --
>> 1 file changed, 2 deletions(-)
>>
>> diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
>> index 3d9bcc9..f9ed1b7 100644
>> --- a/drivers/net/vxlan.c
>> +++ b/drivers/net/vxlan.c
>> @@ -2236,7 +2236,6 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan, struct net_device
>> memset(&fl4, 0, sizeof(fl4));
>> fl4.flowi4_oif = oif;
>> fl4.flowi4_tos = RT_TOS(tos);
>> - fl4.flowi4_mark = skb->mark;
>> fl4.flowi4_proto = IPPROTO_UDP;
>> fl4.daddr = daddr;
>> fl4.saddr = *saddr;
>> @@ -2294,7 +2293,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
>> fl6.daddr = *daddr;
>> fl6.saddr = *saddr;
>> fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
>> - fl6.flowi6_mark = skb->mark;
>> fl6.flowi6_proto = IPPROTO_UDP;
>> fl6.fl6_dport = dport;
>> fl6.fl6_sport = sport;
>> --
>> 2.7.4
>>
>>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4054 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-10-01 15:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-30 6:27 [RFC PATCH] Don't copy mark from encapsulated packet when routing VXLAN Jethro Beekman
2019-10-01 15:30 ` Roopa Prabhu
2019-10-01 15:34 ` Jethro Beekman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).