openvswitch: add IPv6 tunneling support

Store tunnel protocol (AF_INET or AF_INET6) in sw_flow_key. This field now also acts as an indicator whether the flow contains tunnel data (this was previously indicated by tun_key.u.ipv4.dst being set but with IPv6 addresses in an union with IPv4 ones this won't work anymore).

The new field was added to a hole in sw_flow_key.

Signed-off-by Jiri Benc <[email protected]>

---
v2: Set the tun_proto mask to 0xff in ip_tun_from_nlattr.
---

Add netlink attributes for IPv6 tunnel addresses. This enables IPv6 support for tunnels.

Signed-off-by Jiri Benc <[email protected]>

---
v2: Changed description. Rebased tun_proto assignment in ip_tun_from_nlattr
to accomodate changes in the previous patch.
---

We already have ip_tunnel_key_init, this does the same for IPv6. Will be used also by openvswitch in the next patch.

Signed-off-by Jiri Benc <[email protected]>

---
New patch in v2 of the set.

---
 include/net/dst_metadata.h | 18 ++++++------------
 include/net/ip_tunnels.h   | 40 +++++++++++++++++++++++++++++++---------
 2 files changed, 37 insertions(+), 21 deletions(-)

include/net/dst_metadata.h +6 -12

index af9d5382f6cb..30e925aba1a4 100644
@@ -85,23 +85,17 @@ static inline struct metadata_dst *ipv6_tun_rx_dst(struct sk_buff *skb,
 {
        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
        struct metadata_dst *tun_dst;
-       struct ip_tunnel_info *info;
 
        tun_dst = tun_rx_dst(md_size);
        if (!tun_dst)
                return NULL;
 
-       info = &tun_dst->u.tun_info;
-       info->mode = IP_TUNNEL_INFO_IPV6;
-       info->key.tun_flags = flags;
-       info->key.tun_id = tunnel_id;
-       info->key.tp_src = 0;
-       info->key.tp_dst = 0;
-
-       info->key.u.ipv6.src = ip6h->saddr;
-       info->key.u.ipv6.dst = ip6h->daddr;
-       info->key.tos = ipv6_get_dsfield(ip6h);
-       info->key.ttl = ip6h->hop_limit;
+       tun_dst->u.tun_info.mode = IP_TUNNEL_INFO_IPV6;
+       ip6_tunnel_key_init(&tun_dst->u.tun_info.key,
+                           &ip6h->saddr, &ip6h->daddr,
+                           ipv6_get_dsfield(ip6h), ip6h->hop_limit,
+                           0, 0, tunnel_id, flags);
+
        return tun_dst;
 }
 

include/net/ip_tunnels.h +6 -9

index f6dafec9102c..087b2e24e5e0 100644
@@ -179,17 +179,12 @@ int ip_tunnel_encap_add_ops(const struct ip_tunnel_encap_ops *op,
 int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
                            unsigned int num);
 
-static inline void ip_tunnel_key_init(struct ip_tunnel_key *key,
-                                     __be32 saddr, __be32 daddr,
-                                     u8 tos, u8 ttl,
-                                     __be16 tp_src, __be16 tp_dst,
-                                     __be64 tun_id, __be16 tun_flags)
+static inline void __ip_tunnel_key_init(struct ip_tunnel_key *key,
+                                       u8 tos, u8 ttl,
+                                       __be16 tp_src, __be16 tp_dst,
+                                       __be64 tun_id, __be16 tun_flags)
 {
        key->tun_id = tun_id;
-       key->u.ipv4.src = saddr;
-       key->u.ipv4.dst = daddr;
-       memset((unsigned char *)key + IP_TUNNEL_KEY_IPV4_PAD,
-              0, IP_TUNNEL_KEY_IPV4_PAD_LEN);
        key->tos = tos;
        key->ttl = ttl;
        key->tun_flags = tun_flags;

@@ -207,6 +202,33 @@ static inline void ip_tunnel_key_init(struct ip_tunnel_key *key,
                       0, sizeof(*key) - IP_TUNNEL_KEY_SIZE);
 }
 
+static inline void ip_tunnel_key_init(struct ip_tunnel_key *key,
+                                     __be32 saddr, __be32 daddr,

include/net/ip_tunnels.h static inline void ip_tunnel_key_init(struct ip_tunnel_key *key, · line 216

Quoted 12 lines · Jiri Benc

include/net/ip_tunnels.h +12 -0

+static inline void ip_tunnel_key_init(struct ip_tunnel_key *key,
+                                     __be32 saddr, __be32 daddr,
+                                     u8 tos, u8 ttl,
+                                     __be16 tp_src, __be16 tp_dst,
+                                     __be64 tun_id, __be16 tun_flags)
+{
+       __ip_tunnel_key_init(key, tos, ttl, tp_src, tp_dst, tun_id,
+                            tun_flags);
+       key->u.ipv4.src = saddr;
+       key->u.ipv4.dst = daddr;
+       memset((unsigned char *)key + IP_TUNNEL_KEY_IPV4_PAD,
+              0, IP_TUNNEL_KEY_IPV4_PAD_LEN);

neat: since IP_TUNNEL_KEY_IPV4_PAD not really IPv4 tunnel key padding anymore, This also needs to be renamed.

otherwise looks good.

Acked-by Pravin B Shelar <[email protected]>

For compat tunnel interfaces, reject IPv6 keys.

Also fixes a related thinko in vport-vxlan: upcall->egress_tun_info is not yet set at the point where it is used, thus the obtained family is incorrect. As this is IPv4 anyway, just use AF_INET.

Signed-off-by Jiri Benc <[email protected]>

---
New patch in v2 of the set.

---
 net/openvswitch/vport-geneve.c |  4 ++-
 net/openvswitch/vport-gre.c    |  4 ++-
 net/openvswitch/vport-vxlan.c  |  6 ++--
 net/openvswitch/vport.c        | 62 ++++++++++++++++++++++++++++--------------
 net/openvswitch/vport.h        | 26 ++++++++++++++++++
 5 files changed, 77 insertions(+), 25 deletions(-)

net/openvswitch/vport-vxlan.c +3 -3

index fb3cdb85905d..0973acb5432c 100644
@@ -151,8 +151,7 @@ static int vxlan_get_egress_tun_info(struct vport *vport, struct sk_buff *skb,
 {
        struct vxlan_dev *vxlan = netdev_priv(vport->dev);
        struct net *net = ovs_dp_get_net(vport->dp);
-       unsigned short family = ip_tunnel_info_af(upcall->egress_tun_info);
-       __be16 dst_port = vxlan_dev_dst_port(vxlan, family);
+       __be16 dst_port = vxlan_dev_dst_port(vxlan, AF_INET);
        __be16 src_port;
        int port_min;
        int port_max;

@@ -160,7 +159,8 @@ static int vxlan_get_egress_tun_info(struct vport *vport, struct sk_buff *skb,
        inet_get_local_port_range(net, &port_min, &port_max);
        src_port = udp_flow_src_port(net, skb, 0, 0, true);
 
-       return ovs_tunnel_get_egress_info(upcall, net,
+       /* Only IPv4 supported in the compat layer. Pass NULL ipv6 socket. */
+       return ovs_tunnel_get_egress_info(upcall, net, NULL,
                                          skb, IPPROTO_UDP,
                                          src_port, dst_port);
 }

net/openvswitch/vport.c +32 -20

index dc81dc619aa2..c58d95eed5fd 100644
@@ -489,6 +489,7 @@ EXPORT_SYMBOL_GPL(ovs_vport_deferred_free);
 
 int ovs_tunnel_get_egress_info(struct dp_upcall_info *upcall,
                               struct net *net,
+                              struct sock *ipv6_sk,
                               struct sk_buff *skb,
                               u8 ipproto,
                               __be16 tp_src,

@@ -498,13 +499,9 @@ int ovs_tunnel_get_egress_info(struct dp_upcall_info *upcall,
        const struct ip_tunnel_info *tun_info = skb_tunnel_info(skb);
        const struct ip_tunnel_key *tun_key;
        u32 skb_mark = skb->mark;
-       struct rtable *rt;
-       struct flowi4 fl;
 
        if (unlikely(!tun_info))
                return -EINVAL;
-       if (ip_tunnel_info_af(tun_info) != AF_INET)
-               return -EINVAL;
 
        tun_key = &tun_info->key;
 

@@ -512,22 +509,47 @@ int ovs_tunnel_get_egress_info(struct dp_upcall_info *upcall,
         * The process may need to be changed if the corresponding process
         * in vports ops changed.
         */
-       rt = ovs_tunnel_route_lookup(net, tun_key, skb_mark, &fl, ipproto);
-       if (IS_ERR(rt))
-               return PTR_ERR(rt);
-
-       ip_rt_put(rt);
-
-       /* Generate egress_tun_info based on tun_info,
-        * saddr, tp_src and tp_dst
-        */
-       ip_tunnel_key_init(&egress_tun_info->key,
-                          fl.saddr, tun_key->u.ipv4.dst,
-                          tun_key->tos,
-                          tun_key->ttl,
-                          tp_src, tp_dst,
-                          tun_key->tun_id,
-                          tun_key->tun_flags);
+       if (ip_tunnel_info_af(tun_info) == AF_INET) {
+               struct rtable *rt;
+               struct flowi4 fl;
+
+               rt = ovs_tunnel_route_lookup(net, tun_key, skb_mark, &fl, ipproto);
+               if (IS_ERR(rt))
+                       return PTR_ERR(rt);
+
+               ip_rt_put(rt);
+
+               /* Generate egress_tun_info based on tun_info,
+               * saddr, tp_src and tp_dst
+               */
+               ip_tunnel_key_init(&egress_tun_info->key,
+                                  fl.saddr, tun_key->u.ipv4.dst,
+                                  tun_key->tos,
+                                  tun_key->ttl,
+                                  tp_src, tp_dst,
+                                  tun_key->tun_id,
+                                  tun_key->tun_flags);
+       } else {
+               struct dst_entry *ndst;
+               struct flowi6 fl6;
+
+               if (!ipv6_sk)
+                       return -EPFNOSUPPORT;
+
+               ndst = ovs_tunnel6_route_lookup(net, ipv6_sk, tun_key,
+                                               skb_mark, &fl6, ipproto);
+               if (IS_ERR(ndst))
+                       return PTR_ERR(ndst);

I dont see point of adding this code when IPv6 sampling not support by the patch series.

Quoted 2 lines · Pravin Shelar

I dont see point of adding this code when IPv6 sampling not support by the patch series.

It was requested by Jesse:
http://article.gmane.org/gmane.linux.network/380348

I don't mind leaving this and the previous patch out, it's actually what I did in v1.

Jiri

--
Jiri Benc

Quoted 4 lines · Jiri Benc

Quoted 2 lines · Pravin Shelar

I dont see point of adding this code when IPv6 sampling not support by the patch series.

Quoted 3 lines

It was requested by Jesse:
http://article.gmane.org/gmane.linux.network/380348

I don't think we can use this function, lwtunnel device need new ndo_ operation to export this information. So lets defer this patch till we have solution for retrieving egress info from lwtunnel devices.

Quoted 5 lines · Pravin Shelar

Quoted 4 lines · Jiri Benc

Quoted 2 lines · Pravin Shelar

I dont see point of adding this code when IPv6 sampling not support by the patch series.

Quoted 7 lines

Quoted 3 lines

It was requested by Jesse:
http://article.gmane.org/gmane.linux.network/380348

I don't think we can use this function, lwtunnel device need new ndo_ operation to export this information. So lets defer this patch till we have solution for retrieving egress info from lwtunnel devices.

I don't entirely disagree with this but I'm also nervous about completely leaving it out. It seems like when this issue does get fixed, it is likely that the person who does it will just convert whatever code is there and not necessarily think about IPv6 since it's not an IPv6 feature. If that happens, we'll have a hidden problem in IPv6, which is somewhat unfortunately as try to advance IPv6 forward.