Skip to contentSkip to conversation

geneve: add transport ports in route lookup for geneve

PATCH In review Pavel Machek 2 participants 2 messages May 9, 2021 – May 10, 2021 Stable branch

lore
Share & tools
lore

Pavel Machek

author
#0 lore raw

PATCH 1/1 geneve: add transport ports in route lookup for geneve

From: Mark Gray <[email protected]>

[ Upstream commit 34beb21594519ce64a55a498c2fe7d567bc1ca20 ]

This patch adds transport ports information for route lookup so that IPsec can select Geneve tunnel traffic to do encryption. This is needed for OVS/OVN IPsec with encrypted Geneve tunnels.

This can be tested by configuring a host-host VPN using an IKE daemon and specifying port numbers. For example, for an Openswan-type configuration, the following parameters should be configured on both hosts and IPsec set up as-per normal:

$ cat /etc/ipsec.conf

conn in
...
left=$IP1
right=$IP2
...
leftprotoport=udp/6081
rightprotoport=udp
...
conn out
...
left=$IP1
right=$IP2
...
leftprotoport=udp
rightprotoport=udp/6081
...

The tunnel can then be setup using "ip" on both hosts (but changing the relevant IP addresses):

$ ip link add tun type geneve id 1000 remote $IP2
$ ip addr add 192.168.0.1/24 dev tun
$ ip link set tun up

This can then be tested by pinging from $IP1:

$ ping 192.168.0.2

Without this patch the traffic is unencrypted on the wire.

Fixes 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels")
Signed-off-by Qiuyu Xiao <[email protected]>
Signed-off-by Mark Gray <[email protected]>
Reviewed-by Greg Rose <[email protected]>
Signed-off-by David S. Miller <[email protected]>
[backport to 4.4 for CVE-2020-25645]
Signed-off-by Pavel Machek (CIP) <[email protected]>
---
 drivers/net/geneve.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/geneve.c +4 -4
index ee38299f9c57..aa00d71705c6 100644
@@ -842,7 +842,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 
 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
 	rt = geneve_get_v4_rt(skb, dev, &fl4, info,
-			      geneve->dst_port, sport);
+			      info->key.tp_dst, sport);
 	if (IS_ERR(rt)) {
 		err = PTR_ERR(rt);
 		goto tx_error;

@@ -925,7 +925,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 
 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
 	dst = geneve_get_v6_dst(skb, dev, &fl6, info,
-				geneve->dst_port, sport);
+				info->key.tp_dst, sport);
 	if (IS_ERR(dst)) {
 		err = PTR_ERR(dst);
 		goto tx_error;

@@ -1026,7 +1026,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 					  1, USHRT_MAX, true);
 
 		rt = geneve_get_v4_rt(skb, dev, &fl4, info,
-				      geneve->dst_port, sport);
+				      info->key.tp_dst, sport);
 		if (IS_ERR(rt))
 			return PTR_ERR(rt);
 

@@ -1038,7 +1038,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 					  1, USHRT_MAX, true);
 
 		dst = geneve_get_v6_dst(skb, dev, &fl6, info,
-					geneve->dst_port, sport);
+					info->key.tp_dst, sport);
 		if (IS_ERR(dst))
 			return PTR_ERR(dst);
Signature · 10 lines
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany



----- End forwarded message -----

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
#1 lore raw
Quoted 3 lines · Pavel Machek

From: Mark Gray <[email protected]>

[ Upstream commit 34beb21594519ce64a55a498c2fe7d567bc1ca20 ]

This is already in the 4.4.244 release, why do you want it in here again?