* PATCH Question, Firewall mark inherit for ip6_tunnel
@ 2011-09-19 8:47 Hans Schillström
2011-09-19 9:25 ` Eric Dumazet
2011-09-19 16:27 ` [PATCH net-next] ip6_tunnel: add optional fwmark inherit Eric Dumazet
0 siblings, 2 replies; 6+ messages in thread
From: Hans Schillström @ 2011-09-19 8:47 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev@vger.kernel.org
Hello Eric,
For a year ago you send an untested patch to Anders Franzen
I think the subject was "not possible to do policy routing for next hop on tunnels."
The patch have been used since that and it works perfectly,
I made some minor changes to reflect the flowi changes.
Would it be possible for you to submit that patch, since (I guess) you are the author
I can prepare it if you want.
The included patch is for linux-3.0.4
Regards
Hans Schillstrom
diff --git a/include/linux/ip6_tunnel.h b/include/linux/ip6_tunnel.h
index acb9ad6..bf22b03 100644
--- a/include/linux/ip6_tunnel.h
+++ b/include/linux/ip6_tunnel.h
@@ -16,6 +16,8 @@
#define IP6_TNL_F_MIP6_DEV 0x8
/* copy DSCP from the outer packet */
#define IP6_TNL_F_RCV_DSCP_COPY 0x10
+/* copy fwmark from inner packet */
+#define IP6_TNL_F_USE_ORIG_FWMARK 0x20
struct ip6_tnl_parm {
char name[IFNAMSIZ]; /* name of tunnel device */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 36c2842..64be21c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -897,7 +897,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
int err = -1;
int pkt_len;
- if ((dst = ip6_tnl_dst_check(t)) != NULL)
+ if (!fl6->flowi6_mark && (dst = ip6_tnl_dst_check(t)) != NULL)
dst_hold(dst);
else {
dst = ip6_route_output(net, NULL, fl6);
@@ -955,7 +955,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
skb = new_skb;
}
skb_dst_drop(skb);
- skb_dst_set(skb, dst_clone(dst));
+ skb_dst_set(skb, fl6->flowi6_mark ? dst : dst_clone(dst));
skb->transport_header = skb->network_header;
@@ -987,7 +987,9 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
stats->tx_errors++;
stats->tx_aborted_errors++;
}
- ip6_tnl_dst_store(t, dst);
+ if (!fl6->flowi6_mark)
+ ip6_tnl_dst_store(t, dst);
+
return 0;
tx_err_link_failure:
stats->tx_carrier_errors++;
@@ -1023,6 +1025,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
& IPV6_TCLASS_MASK;
+ if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK))
+ fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) {
@@ -1073,7 +1077,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
-
+ if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK))
+ fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) {
if (err == -EMSGSIZE)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: PATCH Question, Firewall mark inherit for ip6_tunnel
2011-09-19 8:47 PATCH Question, Firewall mark inherit for ip6_tunnel Hans Schillström
@ 2011-09-19 9:25 ` Eric Dumazet
2011-09-19 9:52 ` Hans Schillström
2011-09-19 16:27 ` [PATCH net-next] ip6_tunnel: add optional fwmark inherit Eric Dumazet
1 sibling, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2011-09-19 9:25 UTC (permalink / raw)
To: Hans Schillström; +Cc: netdev@vger.kernel.org
Le lundi 19 septembre 2011 à 10:47 +0200, Hans Schillström a écrit :
> Hello Eric,
> For a year ago you send an untested patch to Anders Franzen
> I think the subject was "not possible to do policy routing for next hop on tunnels."
>
> The patch have been used since that and it works perfectly,
> I made some minor changes to reflect the flowi changes.
>
> Would it be possible for you to submit that patch, since (I guess) you are the author
> I can prepare it if you want.
> The included patch is for linux-3.0.4
>
> Regards
> Hans Schillstrom
Hello Hans
Yes, I'll respin this patch on top on net-next, with your "Tested-by"
signature ;)
Thanks
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: PATCH Question, Firewall mark inherit for ip6_tunnel
2011-09-19 9:25 ` Eric Dumazet
@ 2011-09-19 9:52 ` Hans Schillström
2011-09-19 10:32 ` Eric Dumazet
0 siblings, 1 reply; 6+ messages in thread
From: Hans Schillström @ 2011-09-19 9:52 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev@vger.kernel.org
>From: Eric Dumazet [eric.dumazet@gmail.com]
>Sent: Monday, September 19, 2011 11:25
>To: Hans Schillström
>Cc: netdev@vger.kernel.org
>Subject: Re: PATCH Question, Firewall mark inherit for ip6_tunnel
>
>Le lundi 19 septembre 2011 à 10:47 +0200, Hans Schillström a écrit :
>> Hello Eric,
>> For a year ago you send an untested patch to Anders Franzen
>> I think the subject was "not possible to do policy routing for next hop on tunnels."
>>
>> The patch have been used since that and it works perfectly,
>> I made some minor changes to reflect the flowi changes.
>>
>> Would it be possible for you to submit that patch, since (I guess) you are the author
>> I can prepare it if you want.
>> The included patch is for linux-3.0.4
>>
>> Regards
>> Hans Schillstrom
>
>Hello Hans
>
>Yes, I'll respin this patch on top on net-next, with your "Tested-by"
>signature ;)
>
>Thanks
Thanks Eric,
Do you take care of the user mode part as well (i.ie ip commad)
Hans
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net-next] ip6_tunnel: add optional fwmark inherit
2011-09-19 8:47 PATCH Question, Firewall mark inherit for ip6_tunnel Hans Schillström
2011-09-19 9:25 ` Eric Dumazet
@ 2011-09-19 16:27 ` Eric Dumazet
2011-09-20 18:50 ` David Miller
1 sibling, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2011-09-19 16:27 UTC (permalink / raw)
To: Hans Schillström; +Cc: netdev@vger.kernel.org, Anders Franzen
Le lundi 19 septembre 2011 à 10:47 +0200, Hans Schillström a écrit :
> Hello Eric,
> For a year ago you send an untested patch to Anders Franzen
> I think the subject was "not possible to do policy routing for next hop on tunnels."
>
> The patch have been used since that and it works perfectly,
> I made some minor changes to reflect the flowi changes.
>
> Would it be possible for you to submit that patch, since (I guess) you are the author
> I can prepare it if you want.
> The included patch is for linux-3.0.4
Here is an official patch submisssion, for net-next :
Its slightly different than linux-3.0 kernel because of recent changes
on ip6_tunnel.c file.
[PATCH net-next] ip6_tunnel: add optional fwmark inherit
Add IP6_TNL_F_USE_ORIG_FWMARK to ip6_tunnel, so that ip6_tnl_xmit2()
makes a route lookup taking into account skb->fwmark and doesnt cache
lookup result.
This permits more flexibility in policies and firewall setups.
To setup such a tunnel, "fwmark inherit" option should be added to "ip
-f inet6 tunnel" command.
Reported-by: Anders Franzen <Anders.Franzen@ericsson.com>
CC: Hans Schillström <hans.schillstrom@ericsson.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
include/linux/ip6_tunnel.h | 2 ++
net/ipv6/ip6_tunnel.c | 23 +++++++++++++++++-------
2 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/include/linux/ip6_tunnel.h b/include/linux/ip6_tunnel.h
index acb9ad6..bf22b03 100644
--- a/include/linux/ip6_tunnel.h
+++ b/include/linux/ip6_tunnel.h
@@ -16,6 +16,8 @@
#define IP6_TNL_F_MIP6_DEV 0x8
/* copy DSCP from the outer packet */
#define IP6_TNL_F_RCV_DSCP_COPY 0x10
+/* copy fwmark from inner packet */
+#define IP6_TNL_F_USE_ORIG_FWMARK 0x20
struct ip6_tnl_parm {
char name[IFNAMSIZ]; /* name of tunnel device */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 694d70a..bdc15c9 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -889,7 +889,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
struct net_device_stats *stats = &t->dev->stats;
struct ipv6hdr *ipv6h = ipv6_hdr(skb);
struct ipv6_tel_txoption opt;
- struct dst_entry *dst, *ndst = NULL;
+ struct dst_entry *dst = NULL, *ndst = NULL;
struct net_device *tdev;
int mtu;
unsigned int max_headroom = sizeof(struct ipv6hdr);
@@ -897,7 +897,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
int err = -1;
int pkt_len;
- dst = ip6_tnl_dst_check(t);
+ if (!fl6->flowi6_mark)
+ dst = ip6_tnl_dst_check(t);
if (!dst) {
ndst = ip6_route_output(net, NULL, fl6);
@@ -955,8 +956,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
skb = new_skb;
}
skb_dst_drop(skb);
- skb_dst_set_noref(skb, dst);
-
+ if (fl6->flowi6_mark) {
+ skb_dst_set(skb, dst);
+ ndst = NULL;
+ } else {
+ skb_dst_set_noref(skb, dst);
+ }
skb->transport_header = skb->network_header;
proto = fl6->flowi6_proto;
@@ -1021,9 +1026,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
dsfield = ipv4_get_dsfield(iph);
- if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
+ if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
& IPV6_TCLASS_MASK;
+ if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+ fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) {
@@ -1070,10 +1077,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
fl6.flowi6_proto = IPPROTO_IPV6;
dsfield = ipv6_get_dsfield(ipv6h);
- if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
+ if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
- if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
+ if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+ if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+ fl6.flowi6_mark = skb->mark;
err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
if (err != 0) {
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net-next] ip6_tunnel: add optional fwmark inherit
2011-09-19 16:27 ` [PATCH net-next] ip6_tunnel: add optional fwmark inherit Eric Dumazet
@ 2011-09-20 18:50 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2011-09-20 18:50 UTC (permalink / raw)
To: eric.dumazet; +Cc: hans.schillstrom, netdev, Anders.Franzen
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 19 Sep 2011 18:27:26 +0200
> [PATCH net-next] ip6_tunnel: add optional fwmark inherit
>
> Add IP6_TNL_F_USE_ORIG_FWMARK to ip6_tunnel, so that ip6_tnl_xmit2()
> makes a route lookup taking into account skb->fwmark and doesnt cache
> lookup result.
>
> This permits more flexibility in policies and firewall setups.
>
> To setup such a tunnel, "fwmark inherit" option should be added to "ip
> -f inet6 tunnel" command.
>
> Reported-by: Anders Franzen <Anders.Franzen@ericsson.com>
> CC: Hans Schillström <hans.schillstrom@ericsson.com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-09-20 18:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-09-19 8:47 PATCH Question, Firewall mark inherit for ip6_tunnel Hans Schillström
2011-09-19 9:25 ` Eric Dumazet
2011-09-19 9:52 ` Hans Schillström
2011-09-19 10:32 ` Eric Dumazet
2011-09-19 16:27 ` [PATCH net-next] ip6_tunnel: add optional fwmark inherit Eric Dumazet
2011-09-20 18:50 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).