From: Maximilian Bosch <maximilian@mbosch.me>
To: netdev@vger.kernel.org
Subject: Re: VRF Issue Since kernel 5
Date: Wed, 1 Apr 2020 22:35:23 +0200 [thread overview]
Message-ID: <20200401203523.vafhsqb3uxfvvvxq@topsnens> (raw)
In-Reply-To: <b6ead5e9-cc0e-5017-e9a1-98b09b110650@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 4010 bytes --]
Hi!
> This should work:
> make -C tools/testing/selftests/net nettest
> PATH=$PWD/tools/testing/selftests/net:$PATH
> tools/testing/selftests/net/fcnal-test.sh
Thanks, will try this out later.
> If you want that ssh connection to work over a VRF you either need to
> set the shell context:
> ip vrf exec <NAME> su - $USER
>
Yes, using `ip vrf exec` is basically my current workaround.
> or add 'ip vrf exec' before the ssh. If it is an incoming connection to
> a server the ssh server either needs to be bound to the VRF or you need
> 'net.ipv4.tcp_l3mdev_accept = 1'
Does this mean that the `*l3mdev_accept`-parameters only "fix" this
issue if the VRF is on the server I connect to?
In my case the VRF is on my local machine and I try to connect through
the VRF to the server.
> The tcp reset suggests you are doing an outbound connection but the
> lookup for what must be the SYN-ACK is not finding the local socket -
> and that is because of the missing 'ip vrf exec' above.
I only experience this behavior on a 5.x kernel, not on e.g. 4.19
though. I may be wrong, but isn't this a breaking change for userspace
applications in the end?
Thanks!
Maximilian
On Wed, Apr 01, 2020 at 01:18:28PM -0600, David Ahern wrote:
> On 4/1/20 12:16 PM, Maximilian Bosch wrote:
> > Hi!
> >
> > First of all, sorry for my delayed response!
> >
> >> functional test script under tools/testing/selftests/net covers VRF
> >> tests and it ran clean for 5.4 last time I checked. There were a few
> >> changes that went into 4.20 or 5.0 that might be tripping up this use
> >> case, but I need a lot more information.
> >
> > I recently started an attempt to get those tests running on my machine
> > (and a Fedora VM after that), however I had several issues with
> > timeouts (when running `sudo -E make -C tools/testing/selftests TARGETS="net"
> > run_tests`).
> >
> > May I ask if there are further things I need to take care of to get
> > those tests successfully running?
>
> This should work:
> make -C tools/testing/selftests/net nettest
> PATH=$PWD/tools/testing/selftests/net:$PATH
> tools/testing/selftests/net/fcnal-test.sh
>
> >
> >> are you saying wireguard worked with VRF in the past but is not now?
> >
> > No. WireGuard traffic is still working fine. The only issue is
> > TCP-traffic through a VRF (which worked with 4.19, but doesn't anymore
> > with 5.4 and 5.5).
> >
> >> 'ip vrf exec' loads a bpf program and that requires locked memory, so
> >> yes, you need to increase it.
> >
> > Thanks a lot for the explanation!
> >
> >> Let's start with lookups:
> >>
> >> perf record -e fib:* -a -g
> >> <run test that fails, ctrl-c>
> >> perf script
> >
> > For the record, please note that I'm now on Linux 5.5.13.
> >
> > I ran the following command:
> >
> > ```
> > sudo perf record -e fib:* -a -g -- ssh root@92.60.36.231 -o ConnectTimeout=10s
> > ```
>
> If you want that ssh connection to work over a VRF you either need to
> set the shell context:
> ip vrf exec <NAME> su - $USER
>
> or add 'ip vrf exec' before the ssh. If it is an incoming connection to
> a server the ssh server either needs to be bound to the VRF or you need
> 'net.ipv4.tcp_l3mdev_accept = 1'
>
> >
> > The full output can be found here:
> >
> > https://gist.githubusercontent.com/Ma27/a6f83e05f6ffede21c2e27d5c7d27098/raw/4852d97ee4860f7887e16f94a8ede4b4406f07bc/perf-report.txt
>
> seems like you have local rule ahead of the l3mdev rule. The order
> should be:
>
> # ip ru ls
> 1000: from all lookup [l3mdev-table]
> 32765: from all lookup local
> 32766: from all lookup main
>
> That is not the problem, I just noticed some sub-optimal lookups.
>
> The tcp reset suggests you are doing an outbound connection but the
> lookup for what must be the SYN-ACK is not finding the local socket -
> and that is because of the missing 'ip vrf exec' above.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
next prev parent reply other threads:[~2020-04-01 20:35 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-09 7:46 VRF Issue Since kernel 5 Gowen
2019-09-09 9:28 ` Alexis Bauvin
[not found] ` <CWLP265MB1554B902B7F3B43E6E75FD0DFDB70@CWLP265MB1554.GBRP265.PROD.OUTLOOK.COM>
2019-09-09 12:01 ` Alexis Bauvin
2019-09-09 19:43 ` Gowen
2019-09-10 14:22 ` Gowen
2019-09-10 16:36 ` David Ahern
2019-09-11 5:09 ` Gowen
2019-09-11 11:19 ` Gowen
2019-09-11 11:49 ` Gowen
2019-09-11 12:15 ` Mike Manning
[not found] ` <CWLP265MB155485682829AD9B66AB66FCFDB10@CWLP265MB1554.GBRP265.PROD.OUTLOOK.COM>
[not found] ` <CWLP265MB155424EF95E39E98C4502F86FDB10@CWLP265MB1554.GBRP265.PROD.OUTLOOK.COM>
2019-09-11 16:09 ` David Ahern
2019-09-12 6:54 ` Gowen
2020-03-10 20:47 ` Maximilian Bosch
2020-03-12 1:06 ` David Ahern
2020-04-01 18:16 ` Maximilian Bosch
2020-04-01 19:18 ` David Ahern
2020-04-01 20:35 ` Maximilian Bosch [this message]
2020-04-01 20:41 ` David Ahern
2020-04-02 23:02 ` Maximilian Bosch
2020-04-05 16:52 ` David Ahern
2020-04-08 10:07 ` Mike Manning
2020-04-08 15:36 ` David Ahern
2020-04-19 20:35 ` Maximilian Bosch
2019-09-11 16:53 ` David Ahern
2019-09-10 16:39 ` David Ahern
2019-09-11 17:02 ` David Ahern
2019-09-12 6:50 ` Gowen
2019-09-13 17:41 ` David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200401203523.vafhsqb3uxfvvvxq@topsnens \
--to=maximilian@mbosch.me \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).