WireGuard Archive on lore.kernel.org
 help / color / Atom feed
* Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
@ 2019-07-09  8:30 Benedikt Braunger
  2019-07-17 20:54 ` Jason A. Donenfeld
  0 siblings, 1 reply; 6+ messages in thread
From: Benedikt Braunger @ 2019-07-09  8:30 UTC (permalink / raw)
  To: wireguard

Hello Wireguards,

I've been testing wireguard with OpenVZ/Virtuozzo containers [1] which
is based on CentOS and figured out that it is not possible to create a
wireguard net interface within a container. However it is possible to
create it on the host machine and then move it to the containers network
namespace.

I contacted the Virtuozzo Support about this behaviour and they figured
out the reason and released a workaround with a wireguard patch [2]

I have two requests now
* can someone explain me why the `NETIF_F_VIRTUAL` feature is missing in
  [3]? Is this somehow purpose?
* if not, would anything object to merge a patch like this to Wireguard?

Thanks in advance!
Beni

[1] https://de.wikipedia.org/wiki/OpenVZ
[2] https://wiki.openvz.org/VPN_using_Wireguard
[3] https://github.com/WireGuard/WireGuard/blob/master/src/device.c



_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
  2019-07-09  8:30 Wireguard in OpenVZ with NETIF_F_VIRTUAL feature Benedikt Braunger
@ 2019-07-17 20:54 ` Jason A. Donenfeld
  2019-07-17 21:00   ` Jason A. Donenfeld
  0 siblings, 1 reply; 6+ messages in thread
From: Jason A. Donenfeld @ 2019-07-17 20:54 UTC (permalink / raw)
  To: Benedikt Braunger; +Cc: WireGuard mailing list

On Wed, Jul 17, 2019 at 10:40 PM Benedikt Braunger
<b.braunger@syseleven.de> wrote:
> * can someone explain me why the `NETIF_F_VIRTUAL` feature is missing in
>   [3]? Is this somehow purpose?

NETIF_F_VIRTUAL is a OpenVZ-specific thing, right? It's not part of
main line kernel if I understand correctly...

I might be able to hack around that in the compat layer though.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
  2019-07-17 20:54 ` Jason A. Donenfeld
@ 2019-07-17 21:00   ` Jason A. Donenfeld
  2019-07-17 22:41     ` Benedikt Braunger
  0 siblings, 1 reply; 6+ messages in thread
From: Jason A. Donenfeld @ 2019-07-17 21:00 UTC (permalink / raw)
  To: Benedikt Braunger; +Cc: WireGuard mailing list

Can you let me know if a patch like this does the trick?

diff --git a/src/compat/compat.h b/src/compat/compat.h
index 62885500..d28657cb 100644
--- a/src/compat/compat.h
+++ b/src/compat/compat.h
@@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
sk_buff *skb)
 #define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
 #endif

+#ifdef CONFIG_VE
+#define NETIF_F_LLTX (NETIF_F_LLTX | NETIF_F_VIRTUAL)
+#endif
+
 /* https://github.com/ClangBuiltLinux/linux/issues/7 */
 #if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
CONFIG_CLANG_VERSION < 80000)
 #include <linux/bug.h>
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
  2019-07-17 21:00   ` Jason A. Donenfeld
@ 2019-07-17 22:41     ` Benedikt Braunger
  2019-07-19 15:25       ` Jason A. Donenfeld
  0 siblings, 1 reply; 6+ messages in thread
From: Benedikt Braunger @ 2019-07-17 22:41 UTC (permalink / raw)
  To: Jason A. Donenfeld; +Cc: WireGuard mailing list

Hi Jason,

thanks very much for your input. Yes I also realized that the
NETIF_F_VIRTUAL is a Virtuozzo specific thing and almost lost hope with
this.

However with your patch applied I get a failure at dkms build and lots
of warnings in the log that NETIF_F_LLTX is redefined.
I'm not familiar with DKMS stuff but I just wrote around this and got a
working solution with:

diff --git a/usr/src/wireguard-0.0.20190702/compat/compat.h
b/usr/src/wireguard-0.0.20190702/compat/compat.h.patched
index 239fa58..0c61ede 100644
--- a/usr/src/wireguard-0.0.20190702/compat/compat.h
+++ b/usr/src/wireguard-0.0.20190702/compat/compat.h.patched
@@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
sk_buff *skb)
 #define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
 #endif

+#ifdef CONFIG_VE
+#define NETIF_F_LLTX_VIRT (NETIF_F_LLTX | NETIF_F_VIRTUAL)
+#endif
+
 /* https://github.com/ClangBuiltLinux/linux/issues/7 */
 #if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
CONFIG_CLANG_VERSION < 80000)
 #include <linux/bug.h>


diff --git a/usr/src/wireguard-0.0.20190702/device.c
b/usr/src/wireguard-0.0.20190702/device.c.patched
index d17dbf7..8bd1e8a 100644
--- a/usr/src/wireguard-0.0.20190702/device.c
+++ b/usr/src/wireguard-0.0.20190702/device.c.patched
@@ -281,7 +281,11 @@ static void wg_setup(struct net_device *dev)
 #else
        dev->tx_queue_len = 0;
 #endif
+#ifdef NETIF_F_LLTX_VIRT
+       dev->features |= NETIF_F_LLTX_VIRT;
+#else
        dev->features |= NETIF_F_LLTX;
+#endif
        dev->features |= WG_NETDEV_FEATURES;
        dev->hw_features |= WG_NETDEV_FEATURES;
        dev->hw_enc_features |= WG_NETDEV_FEATURES;

Adding a wireguard interface inside the container then works! I'll setup
a working tunnel tomorrow and do some testing with Virtuozzo Linux but I
don't expect any further complications.

If this is the whole thing which is needed to support Virtuozzo Linux,
may this get merged?

Thanks and regards,
Beni

Am 17.07.19 um 23:00 schrieb Jason A. Donenfeld:
> Can you let me know if a patch like this does the trick?
>
> diff --git a/src/compat/compat.h b/src/compat/compat.h
> index 62885500..d28657cb 100644
> --- a/src/compat/compat.h
> +++ b/src/compat/compat.h
> @@ -844,6 +844,10 @@ static inline void skb_mark_not_on_list(struct
> sk_buff *skb)
>  #define cpu_have_named_feature(name) (elf_hwcap & (HWCAP_ ## name))
>  #endif
>
> +#ifdef CONFIG_VE
> +#define NETIF_F_LLTX (NETIF_F_LLTX | NETIF_F_VIRTUAL)
> +#endif
> +
>  /* https://github.com/ClangBuiltLinux/linux/issues/7 */
>  #if defined( __clang__) && (!defined(CONFIG_CLANG_VERSION) ||
> CONFIG_CLANG_VERSION < 80000)
>  #include <linux/bug.h>

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
  2019-07-17 22:41     ` Benedikt Braunger
@ 2019-07-19 15:25       ` Jason A. Donenfeld
  2019-07-19 16:44         ` Benedikt Braunger
  0 siblings, 1 reply; 6+ messages in thread
From: Jason A. Donenfeld @ 2019-07-19 15:25 UTC (permalink / raw)
  To: Benedikt Braunger; +Cc: WireGuard mailing list

How's this look?
https://git.zx2c4.com/WireGuard/commit/?id=08f1bfe29a08d9f10f9fa4c47e07a3501a4a8c8a
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: Wireguard in OpenVZ with NETIF_F_VIRTUAL feature
  2019-07-19 15:25       ` Jason A. Donenfeld
@ 2019-07-19 16:44         ` Benedikt Braunger
  0 siblings, 0 replies; 6+ messages in thread
From: Benedikt Braunger @ 2019-07-19 16:44 UTC (permalink / raw)
  To: Jason A. Donenfeld; +Cc: WireGuard mailing list

Works like a charm! I can compile without any problems and I get
2Gbits/s out of the box between to containers on different hosts.

Thanks a lot!
Beni

Am 19.07.19 um 17:25 schrieb Jason A. Donenfeld:
> How's this look?
> https://git.zx2c4.com/WireGuard/commit/?id=08f1bfe29a08d9f10f9fa4c47e07a3501a4a8c8a

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-09  8:30 Wireguard in OpenVZ with NETIF_F_VIRTUAL feature Benedikt Braunger
2019-07-17 20:54 ` Jason A. Donenfeld
2019-07-17 21:00   ` Jason A. Donenfeld
2019-07-17 22:41     ` Benedikt Braunger
2019-07-19 15:25       ` Jason A. Donenfeld
2019-07-19 16:44         ` Benedikt Braunger

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox