* Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
@ 2019-07-09 8:30 Benedikt Braunger
2019-07-17 20:54 ` Jason A. Donenfeld
0 siblings, 1 reply; 6+ messages in thread
From: Benedikt Braunger @ 2019-07-09 8:30 UTC (permalink / raw)
To: wireguard
Hello Wireguards,
I've been testing wireguard with OpenVZ/Virtuozzo containers [1] which
is based on CentOS and figured out that it is not possible to create a
wireguard net interface within a container. However it is possible to
create it on the host machine and then move it to the containers network
namespace.
I contacted the Virtuozzo Support about this behaviour and they figured
out the reason and released a workaround with a wireguard patch [2]
I have two requests now
* can someone explain me why the `NETIF_F_VIRTUAL` feature is missing in
[3]? Is this somehow purpose?
* if not, would anything object to merge a patch like this to Wireguard?
Thanks in advance!
Beni
[1] https://de.wikipedia.org/wiki/OpenVZ
[2] https://wiki.openvz.org/VPN_using_Wireguard
[3] https://github.com/WireGuard/WireGuard/blob/master/src/device.c
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
2019-07-09 8:30 Wireguard in OpenVZ with NETIF_F_VIRTUAL feature Benedikt Braunger
@ 2019-07-17 20:54 ` Jason A. Donenfeld
2019-07-17 21:00 ` Jason A. Donenfeld
0 siblings, 1 reply; 6+ messages in thread
From: Jason A. Donenfeld @ 2019-07-17 20:54 UTC (permalink / raw)
To: Benedikt Braunger; +Cc: WireGuard mailing list
On Wed, Jul 17, 2019 at 10:40 PM Benedikt Braunger
<b.braunger@syseleven.de> wrote:
> * can someone explain me why the `NETIF_F_VIRTUAL` feature is missing in
> [3]? Is this somehow purpose?
NETIF_F_VIRTUAL is a OpenVZ-specific thing, right? It's not part of
main line kernel if I understand correctly...
I might be able to hack around that in the compat layer though.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
2019-07-17 20:54 ` Jason A. Donenfeld
@ 2019-07-17 21:00 ` Jason A. Donenfeld
2019-07-17 22:41 ` Benedikt Braunger
0 siblings, 1 reply; 6+ messages in thread
From: Jason A. Donenfeld @ 2019-07-17 21:00 UTC (permalink / raw)
To: Benedikt Braunger; +Cc: WireGuard mailing list
Can you let me know if a patch like this does the trick?
diff --git a/src/compat/compat.h b/src/compat/compat.h
index 62885500..d28657cb 100644
--- a/src/compat/compat.h
+++ b/src/compat/compat.h
@@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
sk_buff *skb)
#define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
#endif
+#ifdef CONFIG_VE
+#define NETIF_F_LLTX (NETIF_F_LLTX | NETIF_F_VIRTUAL)
+#endif
+
/* https://github.com/ClangBuiltLinux/linux/issues/7 */
#if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
CONFIG_CLANG_VERSION < 80000)
#include <linux/bug.h>
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
2019-07-17 21:00 ` Jason A. Donenfeld
@ 2019-07-17 22:41 ` Benedikt Braunger
2019-07-19 15:25 ` Jason A. Donenfeld
0 siblings, 1 reply; 6+ messages in thread
From: Benedikt Braunger @ 2019-07-17 22:41 UTC (permalink / raw)
To: Jason A. Donenfeld; +Cc: WireGuard mailing list
Hi Jason,
thanks very much for your input. Yes I also realized that the
NETIF_F_VIRTUAL is a Virtuozzo specific thing and almost lost hope with
this.
However with your patch applied I get a failure at dkms build and lots
of warnings in the log that NETIF_F_LLTX is redefined.
I'm not familiar with DKMS stuff but I just wrote around this and got a
working solution with:
diff --git a/usr/src/wireguard-0.0.20190702/compat/compat.h
b/usr/src/wireguard-0.0.20190702/compat/compat.h.patched
index 239fa58..0c61ede 100644
--- a/usr/src/wireguard-0.0.20190702/compat/compat.h
+++ b/usr/src/wireguard-0.0.20190702/compat/compat.h.patched
@@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
sk_buff *skb)
#define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
#endif
+#ifdef CONFIG_VE
+#define NETIF_F_LLTX_VIRT (NETIF_F_LLTX | NETIF_F_VIRTUAL)
+#endif
+
/* https://github.com/ClangBuiltLinux/linux/issues/7 */
#if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
CONFIG_CLANG_VERSION < 80000)
#include <linux/bug.h>
diff --git a/usr/src/wireguard-0.0.20190702/device.c
b/usr/src/wireguard-0.0.20190702/device.c.patched
index d17dbf7..8bd1e8a 100644
--- a/usr/src/wireguard-0.0.20190702/device.c
+++ b/usr/src/wireguard-0.0.20190702/device.c.patched
@@ -281,7 +281,11 @@ static void wg_setup(struct net_device *dev)
#else
dev->tx_queue_len = 0;
#endif
+#ifdef NETIF_F_LLTX_VIRT
+ dev->features |= NETIF_F_LLTX_VIRT;
+#else
dev->features |= NETIF_F_LLTX;
+#endif
dev->features |= WG_NETDEV_FEATURES;
dev->hw_features |= WG_NETDEV_FEATURES;
dev->hw_enc_features |= WG_NETDEV_FEATURES;
Adding a wireguard interface inside the container then works! I'll setup
a working tunnel tomorrow and do some testing with Virtuozzo Linux but I
don't expect any further complications.
If this is the whole thing which is needed to support Virtuozzo Linux,
may this get merged?
Thanks and regards,
Beni
Am 17.07.19 um 23:00 schrieb Jason A. Donenfeld:
> Can you let me know if a patch like this does the trick?
>
> diff --git a/src/compat/compat.h b/src/compat/compat.h
> index 62885500..d28657cb 100644
> --- a/src/compat/compat.h
> +++ b/src/compat/compat.h
> @@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
> sk_buff *skb)
> #define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
> #endif
>
> +#ifdef CONFIG_VE
> +#define NETIF_F_LLTX (NETIF_F_LLTX | NETIF_F_VIRTUAL)
> +#endif
> +
> /* https://github.com/ClangBuiltLinux/linux/issues/7 */
> #if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
> CONFIG_CLANG_VERSION < 80000)
> #include <linux/bug.h>
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-05 18:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-09 8:30 Wireguard in OpenVZ with NETIF_F_VIRTUAL feature Benedikt Braunger
2019-07-17 20:54 ` Jason A. Donenfeld
2019-07-17 21:00 ` Jason A. Donenfeld
2019-07-17 22:41 ` Benedikt Braunger
2019-07-19 15:25 ` Jason A. Donenfeld
2019-07-19 16:44 ` Benedikt Braunger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).