Skip to content

VXLAN Group Policy Extension

Thomas Graf netdev 6 versions – Applied

Status from this message: Applied, thanks a lot Thomas.

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v6 Latest4 of 5 patches 3 repliesApplied
  2. v55 patches 6 repliesSuperseded
  3. v45 patches 2 repliesSuperseded
Earlier versions · 3
VersionPostedPatchesRepliesStatus
v35 of 6 patches11 repliesSuperseded
v25 of 6 patches11 repliesSuperseded
v16 patches19 repliesSuperseded

4 of 5 patches are in this archive. The cover letter announces 5.

Patches in v6 Applied

#Subject and filesSizeRepliesApplied
1/5vxlan: Group Policy extensiondrivers/net/vxlan.c include/net/vxlan.h include/uapi/linux/if_link.h +1 more+152 -212 replies
2/5vxlan: Only bind to sockets with compatible flags enableddrivers/net/vxlan.c include/net/vxlan.h+21 -110 replies
3/5openvswitch: Rename GENEVE_TUN_OPTS() to TUN_METADATA_OPTS()net/openvswitch/flow.c net/openvswitch/flow.h net/openvswitch/flow_netlink.c+47 -410 replies
5/5openvswitch: Support VXLAN Group Policy extensioninclude/net/ip_tunnels.h include/uapi/linux/openvswitch.h net/openvswitch/flow_netlink.c +3 more+218 -200 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v6 yet.

Read the v6 thread

Cover letter [PATCH 0/5 net-next v6] VXLAN Group Policy Extension

Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc.

The extension is disabled by default and should be run on a distinct port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs which ignore unknown reserved bits will be able to receive VXLAN-GBP frames.

Simple usage example:

10.1.1.1:

   # ip link add vxlan0 type vxlan id 10 remote 10.1.1.2 gbp
   # iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200

10.1.1.2:

   # ip link add vxlan0 type vxlan id 10 remote 10.1.1.1 gbp
   # iptables -I INPUT -m mark --mark 0x200 -j DROP

iproute2 [1] and OVS [2] support will be provided in separate patches.

[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
[1] https://github.com/tgraf/iproute2/tree/vxlan-gbp
[2] https://github.com/tgraf/ovs/tree/vxlan-gbp

Thomas Graf (5):
vxlan: Group Policy extension
vxlan: Only bind to sockets with compatible flags enabled
openvswitch: Rename GENEVE_TUN_OPTS() to TUN_METADATA_OPTS()
openvswitch: Allow for any level of nesting in flow attributes
openvswitch: Support VXLAN Group Policy extension

 drivers/net/vxlan.c              | 113 ++++++++++++----
 include/net/ip_tunnels.h         |   5 +-
 include/net/vxlan.h              |  82 ++++++++++-
 include/uapi/linux/if_link.h     |   1 +
 include/uapi/linux/openvswitch.h |  11 ++
 net/openvswitch/flow.c           |   2 +-
 net/openvswitch/flow.h           |  14 +-
 net/openvswitch/flow_netlink.c   | 286 ++++++++++++++++++++++++++-------------
 net/openvswitch/vport-geneve.c   |  15 +-
 net/openvswitch/vport-vxlan.c    |  91 ++++++++++++-
 net/openvswitch/vport-vxlan.h    |  11 ++
 11 files changed, 491 insertions(+), 140 deletions(-)
 create mode 100644 net/openvswitch/vport-vxlan.h
Signature · 1 line
1.9.3

Read the cover letter in its thread