ICMP rate limiting in IPv4 but not in IPv6

ICMP rate limiting in IPv4 but not in IPv6

[Andy Johnson]

Hello,

I am trying to understand the difference between ICMP rate limiting
in IPv4 and in IPv6.

In IPv4 we have the ability to rate limit ICMPv4 while in IPv6 we do not have
this ability.

To be more code-oriented:
The icmpv4_xrlim_allow() method does inspect the rate mask,
(net->ipv4.sysctl_icmp_ratemask)
whereas the icmpv6_xrlim_allow() method does not inspect the rate mask.

I do not understand why, for example, we can rate limit ICMPv4 messages of
Echo Reply and not rate limit ICMPv6 messages of Echo Reply.

See: icmp_ratemask and icmp_ratelimit in Documentation/networking/ip-sysctl.txt

I believe there is some reason behind it (adding checking of rate mask
seems to me trivial). I try to figure out the reason behind this but I did not
find anything reasonable,

Does anybody happen to know ?

Regards,
Andy

Re: ICMP rate limiting in IPv4 but not in IPv6

[Andy Johnson]

Hello,
After probing into the RFC of ICMPv6, I am even more confused.

RFC 4443 says:

2.4.  Message Processing Rules
...

(f) Finally, in order to limit the bandwidth and forwarding costs
       incurred by originating ICMPv6 error messages, an IPv6 node MUST
       limit the rate of ICMPv6 error messages it originates.
...
The rate-limiting parameters SHOULD be configurable.
...

Any ideas?

regards,
Andy

On Fri, Sep 13, 2013 at 10:21 AM, Andy Johnson <johnsonzjo@gmail.com> wrote:
> Hello,
>
> I am trying to understand the difference between ICMP rate limiting
> in IPv4 and in IPv6.
>
> In IPv4 we have the ability to rate limit ICMPv4 while in IPv6 we do not have
> this ability.
>
> To be more code-oriented:
> The icmpv4_xrlim_allow() method does inspect the rate mask,
> (net->ipv4.sysctl_icmp_ratemask)
> whereas the icmpv6_xrlim_allow() method does not inspect the rate mask.
>
> I do not understand why, for example, we can rate limit ICMPv4 messages of
> Echo Reply and not rate limit ICMPv6 messages of Echo Reply.
>
> See: icmp_ratemask and icmp_ratelimit in Documentation/networking/ip-sysctl.txt
>
> I believe there is some reason behind it (adding checking of rate mask
> seems to me trivial). I try to figure out the reason behind this but I did not
> find anything reasonable,
>
> Does anybody happen to know ?
>
> Regards,
> Andy

Re: ICMP rate limiting in IPv4 but not in IPv6

[Hannes Frederic Sowa]

On Fri, Sep 13, 2013 at 06:57:56PM +0300, Andy Johnson wrote:
> Hello,
> After probing into the RFC of ICMPv6, I am even more confused.
> 
> RFC 4443 says:
> 
> 2.4.  Message Processing Rules
> ...
> 
> (f) Finally, in order to limit the bandwidth and forwarding costs
>        incurred by originating ICMPv6 error messages, an IPv6 node MUST
>        limit the rate of ICMPv6 error messages it originates.
> ...
> The rate-limiting parameters SHOULD be configurable.
> ...
> 
> Any ideas?

Well, nobody has implemented it because nobody missed the feature yet. I
don't believe there is another reason for that. If you come up with a
patch, I am sure it can go upstream.

Do you want to try to come up with a patch? We need to be a bit
careful regarding neighbor discovery but otherwise this should be
relativ straightforward. In the meantime you could also implement such
ratelimiting with netfilter.

Greetings,

  Hannes

Re: ICMP rate limiting in IPv4 but not in IPv6

[Loganaden Velvindron]

On Fri, Sep 13, 2013 at 8:44 PM, Hannes Frederic Sowa
<hannes@stressinduktion.org> wrote:
> On Fri, Sep 13, 2013 at 06:57:56PM +0300, Andy Johnson wrote:
>> Hello,
>> After probing into the RFC of ICMPv6, I am even more confused.
>>
>> RFC 4443 says:
>>
>> 2.4.  Message Processing Rules
>> ...
>>
>> (f) Finally, in order to limit the bandwidth and forwarding costs
>>        incurred by originating ICMPv6 error messages, an IPv6 node MUST
>>        limit the rate of ICMPv6 error messages it originates.
>> ...
>> The rate-limiting parameters SHOULD be configurable.
>> ...
>>
>> Any ideas?
>
> Well, nobody has implemented it because nobody missed the feature yet. I
> don't believe there is another reason for that. If you come up with a
> patch, I am sure it can go upstream.
>
> Do you want to try to come up with a patch? We need to be a bit
> careful regarding neighbor discovery but otherwise this should be
> relativ straightforward. In the meantime you could also implement such
> ratelimiting with netfilter.

Careful ? Can you please elaborate ?


>
> Greetings,
>
>   Hannes
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html



-- 
This message is strictly personal and the opinions expressed do not
represent those of my employers, either past or present.

Re: ICMP rate limiting in IPv4 but not in IPv6

[Hannes Frederic Sowa]

On Fri, Sep 13, 2013 at 09:26:11PM +0400, Loganaden Velvindron wrote:
> On Fri, Sep 13, 2013 at 8:44 PM, Hannes Frederic Sowa
> <hannes@stressinduktion.org> wrote:
> > On Fri, Sep 13, 2013 at 06:57:56PM +0300, Andy Johnson wrote:
> >> Hello,
> >> After probing into the RFC of ICMPv6, I am even more confused.
> >>
> >> RFC 4443 says:
> >>
> >> 2.4.  Message Processing Rules
> >> ...
> >>
> >> (f) Finally, in order to limit the bandwidth and forwarding costs
> >>        incurred by originating ICMPv6 error messages, an IPv6 node MUST
> >>        limit the rate of ICMPv6 error messages it originates.
> >> ...
> >> The rate-limiting parameters SHOULD be configurable.
> >> ...
> >>
> >> Any ideas?
> >
> > Well, nobody has implemented it because nobody missed the feature yet. I
> > don't believe there is another reason for that. If you come up with a
> > patch, I am sure it can go upstream.
> >
> > Do you want to try to come up with a patch? We need to be a bit
> > careful regarding neighbor discovery but otherwise this should be
> > relativ straightforward. In the meantime you could also implement such
> > ratelimiting with netfilter.
> 
> Careful ? Can you please elaborate ?

>From my memory I knew we have rate limiting for redirect messages,
so I assuemed the rate limiter would be on the ndisc_send* path. But
ratelimiting ndisc redirects is a special case and only happens in
ndisc_send_redirect. I assuemd we would need to special case
icmpv6_xrlim_allow to always pass ndisc ns/na packets, sorry.

Maybe we could also switch to icmpv6_xrlim_allow for redirects to make
this configurable?

Btw. for sending redirects we seem to call inet_peer_xrlim_allow once
in the redirect function but also check it in ip6_forward. Maybe we can
drop the check in ip6_forward?

Greetings,

  Hannes

Re: ICMP rate limiting in IPv4 but not in IPv6

[Andy Johnson]

Hello,

My question was out of pure interest and not because of any practical
need. However, preparing a patch for supporting rate limiting for
ICMPv6 is easy and I am ready to do it. I want to know before, what
other people think about it - is it needed ?

regards,
Andy


On Fri, Sep 13, 2013 at 9:17 PM, Hannes Frederic Sowa
<hannes@stressinduktion.org> wrote:
> On Fri, Sep 13, 2013 at 09:26:11PM +0400, Loganaden Velvindron wrote:
>> On Fri, Sep 13, 2013 at 8:44 PM, Hannes Frederic Sowa
>> <hannes@stressinduktion.org> wrote:
>> > On Fri, Sep 13, 2013 at 06:57:56PM +0300, Andy Johnson wrote:
>> >> Hello,
>> >> After probing into the RFC of ICMPv6, I am even more confused.
>> >>
>> >> RFC 4443 says:
>> >>
>> >> 2.4.  Message Processing Rules
>> >> ...
>> >>
>> >> (f) Finally, in order to limit the bandwidth and forwarding costs
>> >>        incurred by originating ICMPv6 error messages, an IPv6 node MUST
>> >>        limit the rate of ICMPv6 error messages it originates.
>> >> ...
>> >> The rate-limiting parameters SHOULD be configurable.
>> >> ...
>> >>
>> >> Any ideas?
>> >
>> > Well, nobody has implemented it because nobody missed the feature yet. I
>> > don't believe there is another reason for that. If you come up with a
>> > patch, I am sure it can go upstream.
>> >
>> > Do you want to try to come up with a patch? We need to be a bit
>> > careful regarding neighbor discovery but otherwise this should be
>> > relativ straightforward. In the meantime you could also implement such
>> > ratelimiting with netfilter.
>>
>> Careful ? Can you please elaborate ?
>
> From my memory I knew we have rate limiting for redirect messages,
> so I assuemed the rate limiter would be on the ndisc_send* path. But
> ratelimiting ndisc redirects is a special case and only happens in
> ndisc_send_redirect. I assuemd we would need to special case
> icmpv6_xrlim_allow to always pass ndisc ns/na packets, sorry.
>
> Maybe we could also switch to icmpv6_xrlim_allow for redirects to make
> this configurable?
>
> Btw. for sending redirects we seem to call inet_peer_xrlim_allow once
> in the redirect function but also check it in ip6_forward. Maybe we can
> drop the check in ip6_forward?
>
> Greetings,
>
>   Hannes
>

GRE support for IPv6

[Templin, Fred L]

Hi,

Someone recently added the module ./net/ipv6/ip6_gre.c to the
kernel, but I cannot find any obvious way to configure it using
iproute2. Is there any userland code available for turning on
GRE tunnels for IPv6?

Thanks - Fred
fred.l.templin@boeing.com

Re: ICMP rate limiting in IPv4 but not in IPv6

[Hannes Frederic Sowa]

On Fri, Sep 13, 2013 at 09:26:08PM +0300, Andy Johnson wrote:
> Hello,
> 
> My question was out of pure interest and not because of any practical
> need. However, preparing a patch for supporting rate limiting for
> ICMPv6 is easy and I am ready to do it. I want to know before, what
> other people think about it - is it needed ?

*shrug*

I don't know. I haven't needed it yet but could think of artificial
situations where it could be handy. :)

Re: GRE support for IPv6

[Hannes Frederic Sowa]

On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> Someone recently added the module ./net/ipv6/ip6_gre.c to the
> kernel, but I cannot find any obvious way to configure it using
> iproute2. Is there any userland code available for turning on
> GRE tunnels for IPv6?

I guess it got lost somehow:

http://patchwork.ozlabs.org/patch/173836/

RE: GRE support for IPv6

[Templin, Fred L]

Thanks Hannes,

I'd like to see this patch make it into the iproute2 distribution.
Can someone take care of this?

Fred
fred.l.templin@boeing.com

> -----Original Message-----
> From: netdev-owner@vger.kernel.org [mailto:netdev-
> owner@vger.kernel.org] On Behalf Of Hannes Frederic Sowa
> Sent: Friday, September 13, 2013 2:01 PM
> To: Templin, Fred L
> Cc: netdev@vger.kernel.org; xeb@mail.ru; stephen@networkplumber.org
> Subject: Re: GRE support for IPv6
> 
> On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> > Someone recently added the module ./net/ipv6/ip6_gre.c to the
> > kernel, but I cannot find any obvious way to configure it using
> > iproute2. Is there any userland code available for turning on
> > GRE tunnels for IPv6?
> 
> I guess it got lost somehow:
> 
> http://patchwork.ozlabs.org/patch/173836/
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: GRE support for IPv6

[Stephen Hemminger]

On Fri, 13 Sep 2013 23:01:05 +0200
Hannes Frederic Sowa <hannes@stressinduktion.org> wrote:

> On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> > Someone recently added the module ./net/ipv6/ip6_gre.c to the
> > kernel, but I cannot find any obvious way to configure it using
> > iproute2. Is there any userland code available for turning on
> > GRE tunnels for IPv6?
> 
> I guess it got lost somehow:
> 
> http://patchwork.ozlabs.org/patch/173836/
> 

The patch was submitted before the kernel code made it to Linus.
And was not resubmitted. To deal with this in later releases I started
keeping a next branch but that only started after 3.10

Re: GRE support for IPv6

[Stephen Hemminger]

On Fri, 13 Sep 2013 14:46:30 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> On Fri, 13 Sep 2013 23:01:05 +0200
> Hannes Frederic Sowa <hannes@stressinduktion.org> wrote:
> 
> > On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> > > Someone recently added the module ./net/ipv6/ip6_gre.c to the
> > > kernel, but I cannot find any obvious way to configure it using
> > > iproute2. Is there any userland code available for turning on
> > > GRE tunnels for IPv6?
> > 
> > I guess it got lost somehow:
> > 
> > http://patchwork.ozlabs.org/patch/173836/

That patch is out of date and does not apply cleanly to current iproute2

RE: GRE support for IPv6

[Templin, Fred L]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

Hi Stephen,

See attached for the patches as applied to iproute2-3.10.0.
The code compiles cleanly - testing is in progress.

Thanks - Fred

> -----Original Message-----
> From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> Sent: Friday, September 13, 2013 3:06 PM
> To: Stephen Hemminger
> Cc: Hannes Frederic Sowa; Templin, Fred L; netdev@vger.kernel.org;
> xeb@mail.ru
> Subject: Re: GRE support for IPv6
> 
> On Fri, 13 Sep 2013 14:46:30 -0700
> Stephen Hemminger <stephen@networkplumber.org> wrote:
> 
> > On Fri, 13 Sep 2013 23:01:05 +0200
> > Hannes Frederic Sowa <hannes@stressinduktion.org> wrote:
> >
> > > On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> > > > Someone recently added the module ./net/ipv6/ip6_gre.c to the
> > > > kernel, but I cannot find any obvious way to configure it using
> > > > iproute2. Is there any userland code available for turning on
> > > > GRE tunnels for IPv6?
> > >
> > > I guess it got lost somehow:
> > >
> > > http://patchwork.ozlabs.org/patch/173836/
> 
> That patch is out of date and does not apply cleanly to current
> iproute2

[-- Attachment #2: ip6_gre.diffs --]
[-- Type: application/octet-stream, Size: 19470 bytes --]

--- ip/Makefile.orig	2013-09-13 15:21:45.628514535 -0700
+++ ip/Makefile	2013-09-13 14:32:35.726300427 -0700
@@ -5,7 +5,7 @@
     iplink_vlan.o link_veth.o link_gre.o iplink_can.o \
     iplink_macvlan.o iplink_macvtap.o ipl2tp.o link_vti.o \
     iplink_vxlan.o tcp_metrics.o iplink_ipoib.o ipnetconf.o link_ip6tnl.o \
-    link_iptnl.o
+    link_iptnl.o link_gre6.o
 
 RTMONOBJ=rtmon.o
 
--- ip/ip6tunnel.c.orig	2013-09-13 15:31:09.236580387 -0700
+++ ip/ip6tunnel.c	2013-09-13 15:22:49.273425396 -0700
@@ -48,11 +48,12 @@
 static void usage(void)
 {
 	fprintf(stderr, "Usage: ip -f inet6 tunnel { add | change | del | show } [ NAME ]\n");
-	fprintf(stderr, "          [ mode { ip6ip6 | ipip6 | any } ]\n");
+	fprintf(stderr, "          [ mode { ip6ip6 | ipip6 | ip6gre | any } ]\n");
 	fprintf(stderr, "          [ remote ADDR local ADDR ] [ dev PHYS_DEV ]\n");
 	fprintf(stderr, "          [ encaplimit ELIM ]\n");
 	fprintf(stderr ,"          [ hoplimit TTL ] [ tclass TCLASS ] [ flowlabel FLOWLABEL ]\n");
 	fprintf(stderr, "          [ dscp inherit ]\n");
+	fprintf(stderr, "          [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ]\n");
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Where: NAME      := STRING\n");
 	fprintf(stderr, "       ADDR      := IPV6_ADDRESS\n");
@@ -62,10 +63,11 @@
 		DEFAULT_TNL_HOP_LIMIT);
 	fprintf(stderr, "       TCLASS    := { 0x0..0xff | inherit }\n");
 	fprintf(stderr, "       FLOWLABEL := { 0x0..0xfffff | inherit }\n");
+	fprintf(stderr, "       KEY       := { DOTTED_QUAD | NUMBER }\n");
 	exit(-1);
 }
 
-static void print_tunnel(struct ip6_tnl_parm *p)
+static void print_tunnel(struct ip6_tnl_parm2 *p)
 {
 	char remote[64];
 	char local[64];
@@ -104,9 +106,29 @@
 
 	if (p->flags & IP6_TNL_F_RCV_DSCP_COPY)
 		printf(" dscp inherit");
+	
+	if (p->proto == IPPROTO_GRE) {
+		if ((p->i_flags&GRE_KEY) && (p->o_flags&GRE_KEY) && p->o_key == p->i_key)
+			printf(" key %u", ntohl(p->i_key));
+		else if ((p->i_flags|p->o_flags)&GRE_KEY) {
+			if (p->i_flags&GRE_KEY)
+				printf(" ikey %u ", ntohl(p->i_key));
+			if (p->o_flags&GRE_KEY)
+				printf(" okey %u ", ntohl(p->o_key));
+		}
+
+		if (p->i_flags&GRE_SEQ)
+			printf("%s  Drop packets out of sequence.\n", _SL_);
+		if (p->i_flags&GRE_CSUM)
+			printf("%s  Checksum in received packet is required.", _SL_);
+		if (p->o_flags&GRE_SEQ)
+			printf("%s  Sequence packets on output.", _SL_);
+		if (p->o_flags&GRE_CSUM)
+			printf("%s  Checksum output packets.", _SL_);
+	}
 }
 
-static int parse_args(int argc, char **argv, int cmd, struct ip6_tnl_parm *p)
+static int parse_args(int argc, char **argv, int cmd, struct ip6_tnl_parm2 *p)
 {
 	int count = 0;
 	char medium[IFNAMSIZ];
@@ -124,6 +146,9 @@
 				 strcmp(*argv, "ipip6") == 0 ||
 				 strcmp(*argv, "ip4ip6") == 0)
 				p->proto = IPPROTO_IPIP;
+			else if (strcmp(*argv, "ip6gre") == 0 ||
+				 strcmp(*argv, "gre/ipv6") == 0)
+				p->proto = IPPROTO_GRE;
 			else if (strcmp(*argv, "any/ipv6") == 0 ||
 				 strcmp(*argv, "any") == 0)
 				p->proto = 0;
@@ -202,6 +227,60 @@
 			if (strcmp(*argv, "inherit") != 0)
 				invarg("not inherit", *argv);
 			p->flags |= IP6_TNL_F_RCV_DSCP_COPY;
+		} else if (strcmp(*argv, "key") == 0) {
+			unsigned uval;
+			NEXT_ARG();
+			p->i_flags |= GRE_KEY;
+			p->o_flags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				p->i_key = p->o_key = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0)<0) {
+					fprintf(stderr, "invalid value of \"key\"\n");
+					exit(-1);
+				}
+				p->i_key = p->o_key = htonl(uval);
+			}
+		} else if (strcmp(*argv, "ikey") == 0) {
+			unsigned uval;
+			NEXT_ARG();
+			p->i_flags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				p->i_key = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0)<0) {
+					fprintf(stderr, "invalid value of \"ikey\"\n");
+					exit(-1);
+				}
+				p->i_key = htonl(uval);
+			}
+		} else if (strcmp(*argv, "okey") == 0) {
+			unsigned uval;
+			NEXT_ARG();
+			p->o_flags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				p->o_key = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0)<0) {
+					fprintf(stderr, "invalid value of \"okey\"\n");
+					exit(-1);
+				}
+				p->o_key = htonl(uval);
+			}
+		} else if (strcmp(*argv, "seq") == 0) {
+			p->i_flags |= GRE_SEQ;
+			p->o_flags |= GRE_SEQ;
+		} else if (strcmp(*argv, "iseq") == 0) {
+			p->i_flags |= GRE_SEQ;
+		} else if (strcmp(*argv, "oseq") == 0) {
+			p->o_flags |= GRE_SEQ;
+		} else if (strcmp(*argv, "csum") == 0) {
+			p->i_flags |= GRE_CSUM;
+			p->o_flags |= GRE_CSUM;
+		} else if (strcmp(*argv, "icsum") == 0) {
+			p->i_flags |= GRE_CSUM;
+		} else if (strcmp(*argv, "ocsum") == 0) {
+			p->o_flags |= GRE_CSUM;
 		} else {
 			if (strcmp(*argv, "name") == 0) {
 				NEXT_ARG();
@@ -212,7 +291,7 @@
 				duparg2("name", *argv);
 			strncpy(p->name, *argv, IFNAMSIZ - 1);
 			if (cmd == SIOCCHGTUNNEL && count == 0) {
-				struct ip6_tnl_parm old_p;
+				struct ip6_tnl_parm2 old_p;
 				memset(&old_p, 0, sizeof(old_p));
 				if (tnl_get_ioctl(*argv, &old_p))
 					return -1;
@@ -230,7 +309,7 @@
 	return 0;
 }
 
-static void ip6_tnl_parm_init(struct ip6_tnl_parm *p, int apply_default)
+static void ip6_tnl_parm_init(struct ip6_tnl_parm2 *p, int apply_default)
 {
 	memset(p, 0, sizeof(*p));
 	p->proto = IPPROTO_IPV6;
@@ -244,8 +323,8 @@
  * @p1: user specified parameter
  * @p2: database entry
  */
-static int ip6_tnl_parm_match(const struct ip6_tnl_parm *p1,
-			      const struct ip6_tnl_parm *p2)
+static int ip6_tnl_parm_match(const struct ip6_tnl_parm2 *p1,
+			      const struct ip6_tnl_parm2 *p2)
 {
 	return ((!p1->link || p1->link == p2->link) &&
 		(!p1->name[0] || strcmp(p1->name, p2->name) == 0) &&
@@ -263,7 +342,7 @@
 		(!p1->flags || (p1->flags & p2->flags)));
 }
 
-static int do_tunnels_list(struct ip6_tnl_parm *p)
+static int do_tunnels_list(struct ip6_tnl_parm2 *p)
 {
 	char buf[512];
 	int err = -1;
@@ -287,7 +366,7 @@
 			rx_fifo, rx_frame,
 			tx_bytes, tx_packets, tx_errs, tx_drops,
 			tx_fifo, tx_colls, tx_carrier, rx_multi;
-		struct ip6_tnl_parm p1;
+		struct ip6_tnl_parm2 p1;
 		char *ptr;
 
 		buf[sizeof(buf) - 1] = '\0';
@@ -312,10 +391,12 @@
 			fprintf(stderr, "Failed to get type of \"%s\"\n", name);
 			continue;
 		}
-		if (type != ARPHRD_TUNNEL6)
+		if (type != ARPHRD_TUNNEL6 && type != ARPHRD_IP6GRE)
 			continue;
 		memset(&p1, 0, sizeof(p1));
 		ip6_tnl_parm_init(&p1, 0);
+		if (type == ARPHRD_IP6GRE)
+			p1.proto = IPPROTO_GRE;
 		strcpy(p1.name, name);
 		p1.link = ll_name_to_index(p1.name);
 		if (p1.link == 0)
@@ -346,7 +427,7 @@
 
 static int do_show(int argc, char **argv)
 {
-        struct ip6_tnl_parm p;
+        struct ip6_tnl_parm2 p;
 
 	ll_init_map(&rth);
 	ip6_tnl_parm_init(&p, 0);
@@ -369,28 +450,44 @@
 
 static int do_add(int cmd, int argc, char **argv)
 {
-	struct ip6_tnl_parm p;
+	struct ip6_tnl_parm2 p;
 
 	ip6_tnl_parm_init(&p, 1);
 
 	if (parse_args(argc, argv, cmd, &p) < 0)
 		return -1;
 
-	return tnl_add_ioctl(cmd,
-			     cmd == SIOCCHGTUNNEL && p.name[0] ?
-			     p.name : "ip6tnl0", p.name, &p);
+	switch (p.proto) {
+	case IPPROTO_IPIP:
+	case IPPROTO_IPV6:
+		return tnl_add_ioctl(cmd, "ip6tnl0", p.name, &p);
+	case IPPROTO_GRE:
+		return tnl_add_ioctl(cmd, "ip6gre0", p.name, &p);
+	default:
+		fprintf(stderr, "cannot determine tunnel mode (ip6ip6, ipip6 or gre)\n");
+	}
+	return -1;
 }
 
 static int do_del(int argc, char **argv)
 {
-	struct ip6_tnl_parm p;
+	struct ip6_tnl_parm2 p;
 
 	ip6_tnl_parm_init(&p, 1);
 
 	if (parse_args(argc, argv, SIOCDELTUNNEL, &p) < 0)
 		return -1;
 
-	return tnl_del_ioctl(p.name[0] ? p.name : "ip6tnl0", p.name, &p);
+	switch (p.proto) {
+	case IPPROTO_IPIP:
+	case IPPROTO_IPV6:
+		return tnl_del_ioctl("ip6tnl0", p.name, &p);
+	case IPPROTO_GRE:
+		return tnl_del_ioctl("ip6gre0", p.name, &p);
+	default:
+		return tnl_del_ioctl(p.name, p.name, &p);
+	}
+	return -1;
 }
 
 int do_ip6tunnel(int argc, char **argv)
--- ip/link_gre6.c.orig	2013-09-13 15:26:29.992583461 -0700
+++ ip/link_gre6.c	2013-09-13 14:29:13.379403261 -0700
@@ -0,0 +1,397 @@
+/*
+ * link_gre.c	gre driver module
+ *
+ *		This program is free software; you can redistribute it and/or
+ *		modify it under the terms of the GNU General Public License
+ *		as published by the Free Software Foundation; either version
+ *		2 of the License, or (at your option) any later version.
+ *
+ * Authors:	Herbert Xu <herbert@gondor.apana.org.au>
+ *
+ */
+
+#include <string.h>
+#include <net/if.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <linux/ip.h>
+#include <linux/if_tunnel.h>
+#include <linux/ip6_tunnel.h>
+
+#include "rt_names.h"
+#include "utils.h"
+#include "ip_common.h"
+#include "tunnel.h"
+
+#define IP6_FLOWINFO_TCLASS	htonl(0x0FF00000)
+#define IP6_FLOWINFO_FLOWLABEL	htonl(0x000FFFFF)
+
+#define DEFAULT_TNL_HOP_LIMIT	(64)
+
+static void usage(void) __attribute__((noreturn));
+static void usage(void)
+{
+	fprintf(stderr, "Usage: ip link { add | set | change | replace | del } NAME\n");
+	fprintf(stderr, "          type { ip6gre | ip6gretap } [ remote ADDR ] [ local ADDR ]\n");
+	fprintf(stderr, "          [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ]\n");
+	fprintf(stderr, "          [ hoplimit TTL ] [ encaplimit ELIM ]\n");
+	fprintf(stderr, "          [ tclass TCLASS ] [ flowlabel FLOWLABEL ]\n");
+	fprintf(stderr, "          [ dscp inherit ] [ dev PHYS_DEV ]\n");
+	fprintf(stderr, "\n");
+	fprintf(stderr, "Where: NAME      := STRING\n");
+	fprintf(stderr, "       ADDR      := IPV6_ADDRESS\n");
+	fprintf(stderr, "       TTL       := { 0..255 } (default=%d)\n",
+		DEFAULT_TNL_HOP_LIMIT);
+	fprintf(stderr, "       KEY       := { DOTTED_QUAD | NUMBER }\n");
+	fprintf(stderr, "       ELIM      := { none | 0..255 }(default=%d)\n",
+		IPV6_DEFAULT_TNL_ENCAP_LIMIT);
+	fprintf(stderr, "       FLOWLABEL := { 0x0..0xfffff | inherit }\n");
+	exit(-1);
+}
+
+static int gre_parse_opt(struct link_util *lu, int argc, char **argv,
+			 struct nlmsghdr *n)
+{
+	struct {
+		struct nlmsghdr n;
+		struct ifinfomsg i;
+		char buf[1024];
+	} req;
+	struct ifinfomsg *ifi = (struct ifinfomsg *)(n + 1);
+	struct rtattr *tb[IFLA_MAX + 1];
+	struct rtattr *linkinfo[IFLA_INFO_MAX+1];
+	struct rtattr *greinfo[IFLA_GRE_MAX + 1];
+	__u16 iflags = 0;
+	__u16 oflags = 0;
+	unsigned ikey = 0;
+	unsigned okey = 0;
+	struct in6_addr raddr = IN6ADDR_ANY_INIT;
+	struct in6_addr laddr = IN6ADDR_ANY_INIT;
+	unsigned link = 0;
+	unsigned flowinfo = 0;
+	unsigned flags = 0;
+	__u8 hop_limit = DEFAULT_TNL_HOP_LIMIT;
+	__u8 encap_limit = IPV6_DEFAULT_TNL_ENCAP_LIMIT;
+	int len;
+
+	if (!(n->nlmsg_flags & NLM_F_CREATE)) {
+		memset(&req, 0, sizeof(req));
+
+		req.n.nlmsg_len = NLMSG_LENGTH(sizeof(*ifi));
+		req.n.nlmsg_flags = NLM_F_REQUEST;
+		req.n.nlmsg_type = RTM_GETLINK;
+		req.i.ifi_family = preferred_family;
+		req.i.ifi_index = ifi->ifi_index;
+
+		if (rtnl_talk(&rth, &req.n, 0, 0, &req.n) < 0) {
+get_failed:
+			fprintf(stderr,
+				"Failed to get existing tunnel info.\n");
+			return -1;
+		}
+
+		len = req.n.nlmsg_len;
+		len -= NLMSG_LENGTH(sizeof(*ifi));
+		if (len < 0)
+			goto get_failed;
+
+		parse_rtattr(tb, IFLA_MAX, IFLA_RTA(&req.i), len);
+
+		if (!tb[IFLA_LINKINFO])
+			goto get_failed;
+
+		parse_rtattr_nested(linkinfo, IFLA_INFO_MAX, tb[IFLA_LINKINFO]);
+
+		if (!linkinfo[IFLA_INFO_DATA])
+			goto get_failed;
+
+		parse_rtattr_nested(greinfo, IFLA_GRE_MAX,
+				    linkinfo[IFLA_INFO_DATA]);
+
+		if (greinfo[IFLA_GRE_IKEY])
+			ikey = rta_getattr_u32(greinfo[IFLA_GRE_IKEY]);
+
+		if (greinfo[IFLA_GRE_OKEY])
+			okey = rta_getattr_u32(greinfo[IFLA_GRE_OKEY]);
+
+		if (greinfo[IFLA_GRE_IFLAGS])
+			iflags = rta_getattr_u16(greinfo[IFLA_GRE_IFLAGS]);
+
+		if (greinfo[IFLA_GRE_OFLAGS])
+			oflags = rta_getattr_u16(greinfo[IFLA_GRE_OFLAGS]);
+
+		if (greinfo[IFLA_GRE_LOCAL])
+			memcpy(&laddr, RTA_DATA(greinfo[IFLA_GRE_LOCAL]), sizeof(laddr));
+
+		if (greinfo[IFLA_GRE_REMOTE])
+			memcpy(&raddr, RTA_DATA(greinfo[IFLA_GRE_REMOTE]), sizeof(raddr));
+
+		if (greinfo[IFLA_GRE_TTL])
+			hop_limit = rta_getattr_u8(greinfo[IFLA_GRE_TTL]);
+
+		if (greinfo[IFLA_GRE_LINK])
+			link = rta_getattr_u32(greinfo[IFLA_GRE_LINK]);
+		
+		if (greinfo[IFLA_GRE_ENCAP_LIMIT])
+			encap_limit = rta_getattr_u8(greinfo[IFLA_GRE_ENCAP_LIMIT]);
+		
+		if (greinfo[IFLA_GRE_FLOWINFO])
+			flowinfo = rta_getattr_u32(greinfo[IFLA_GRE_FLOWINFO]);
+		
+		if (greinfo[IFLA_GRE_FLAGS])
+			flags = rta_getattr_u32(greinfo[IFLA_GRE_FLAGS]);
+	}
+
+	while (argc > 0) {
+		if (!matches(*argv, "key")) {
+			unsigned uval;
+
+			NEXT_ARG();
+			iflags |= GRE_KEY;
+			oflags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				uval = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0) < 0) {
+					fprintf(stderr,
+						"Invalid value for \"key\"\n");
+					exit(-1);
+				}
+				uval = htonl(uval);
+			}
+
+			ikey = okey = uval;
+		} else if (!matches(*argv, "ikey")) {
+			unsigned uval;
+
+			NEXT_ARG();
+			iflags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				uval = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0)<0) {
+					fprintf(stderr, "invalid value of \"ikey\"\n");
+					exit(-1);
+				}
+				uval = htonl(uval);
+			}
+			ikey = uval;
+		} else if (!matches(*argv, "okey")) {
+			unsigned uval;
+
+			NEXT_ARG();
+			oflags |= GRE_KEY;
+			if (strchr(*argv, '.'))
+				uval = get_addr32(*argv);
+			else {
+				if (get_unsigned(&uval, *argv, 0)<0) {
+					fprintf(stderr, "invalid value of \"okey\"\n");
+					exit(-1);
+				}
+				uval = htonl(uval);
+			}
+			okey = uval;
+		} else if (!matches(*argv, "seq")) {
+			iflags |= GRE_SEQ;
+			oflags |= GRE_SEQ;
+		} else if (!matches(*argv, "iseq")) {
+			iflags |= GRE_SEQ;
+		} else if (!matches(*argv, "oseq")) {
+			oflags |= GRE_SEQ;
+		} else if (!matches(*argv, "csum")) {
+			iflags |= GRE_CSUM;
+			oflags |= GRE_CSUM;
+		} else if (!matches(*argv, "icsum")) {
+			iflags |= GRE_CSUM;
+		} else if (!matches(*argv, "ocsum")) {
+			oflags |= GRE_CSUM;
+		} else if (!matches(*argv, "remote")) {
+			inet_prefix addr;
+			NEXT_ARG();
+			get_prefix(&addr, *argv, preferred_family);
+			if (addr.family == AF_UNSPEC)
+				invarg("\"remote\" address family is AF_UNSPEC", *argv);
+			memcpy(&raddr, &addr.data, sizeof(raddr));
+		} else if (!matches(*argv, "local")) {
+			inet_prefix addr;
+			NEXT_ARG();
+			get_prefix(&addr, *argv, preferred_family);
+			if (addr.family == AF_UNSPEC)
+				invarg("\"local\" address family is AF_UNSPEC", *argv);
+			memcpy(&laddr, &addr.data, sizeof(laddr));
+		} else if (!matches(*argv, "dev")) {
+			NEXT_ARG();
+			link = if_nametoindex(*argv);
+			if (link == 0)
+				exit(-1);
+		} else if (!matches(*argv, "ttl") ||
+			   !matches(*argv, "hoplimit")) {
+			__u8 uval;
+			NEXT_ARG();
+			if (get_u8(&uval, *argv, 0))
+				invarg("invalid TTL", *argv);
+			hop_limit = uval;
+		} else if (!matches(*argv, "tos") ||
+			   !matches(*argv, "tclass") ||
+			   !matches(*argv, "dsfield")) {
+			__u8 uval;
+			NEXT_ARG();
+			if (strcmp(*argv, "inherit") == 0)
+				flags |= IP6_TNL_F_USE_ORIG_TCLASS;
+			else {
+				if (get_u8(&uval, *argv, 16))
+					invarg("invalid TClass", *argv);
+				flowinfo |= htonl((__u32)uval << 20) & IP6_FLOWINFO_TCLASS;
+				flags &= ~IP6_TNL_F_USE_ORIG_TCLASS;
+			}
+		} else if (strcmp(*argv, "flowlabel") == 0 ||
+			   strcmp(*argv, "fl") == 0) {
+			__u32 uval;
+			NEXT_ARG();
+			if (strcmp(*argv, "inherit") == 0)
+				flags |= IP6_TNL_F_USE_ORIG_FLOWLABEL;
+			else {
+				if (get_u32(&uval, *argv, 16))
+					invarg("invalid Flowlabel", *argv);
+				if (uval > 0xFFFFF)
+					invarg("invalid Flowlabel", *argv);
+				flowinfo |= htonl(uval) & IP6_FLOWINFO_FLOWLABEL;
+				flags &= ~IP6_TNL_F_USE_ORIG_FLOWLABEL;
+			}
+		} else if (strcmp(*argv, "dscp") == 0) {
+			NEXT_ARG();
+			if (strcmp(*argv, "inherit") != 0)
+				invarg("not inherit", *argv);
+			flags |= IP6_TNL_F_RCV_DSCP_COPY;
+		} else 
+			usage();
+		argc--; argv++;
+	}
+
+	addattr32(n, 1024, IFLA_GRE_IKEY, ikey);
+	addattr32(n, 1024, IFLA_GRE_OKEY, okey);
+	addattr_l(n, 1024, IFLA_GRE_IFLAGS, &iflags, 2);
+	addattr_l(n, 1024, IFLA_GRE_OFLAGS, &oflags, 2);
+	addattr_l(n, 1024, IFLA_GRE_LOCAL, &laddr, sizeof(laddr));
+	addattr_l(n, 1024, IFLA_GRE_REMOTE, &raddr, sizeof(raddr));
+	if (link)
+		addattr32(n, 1024, IFLA_GRE_LINK, link);
+	addattr_l(n, 1024, IFLA_GRE_TTL, &hop_limit, 1);
+	addattr_l(n, 1024, IFLA_GRE_ENCAP_LIMIT, &encap_limit, 1);
+	addattr_l(n, 1024, IFLA_GRE_FLOWINFO, &flowinfo, 4);
+	addattr_l(n, 1024, IFLA_GRE_FLAGS, &flowinfo, 4);
+
+	return 0;
+}
+
+static void gre_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
+{
+	char s1[1024];
+	char s2[64];
+	const char *local = "any";
+	const char *remote = "any";
+	unsigned iflags = 0;
+	unsigned oflags = 0;
+	unsigned flags = 0;
+	unsigned flowinfo = 0;
+	struct in6_addr in6_addr_any = IN6ADDR_ANY_INIT;
+
+	if (!tb)
+		return;
+
+	if (tb[IFLA_GRE_FLAGS])
+		flags = rta_getattr_u32(tb[IFLA_GRE_FLAGS]);
+	
+	if (tb[IFLA_GRE_FLOWINFO])
+		flags = rta_getattr_u32(tb[IFLA_GRE_FLOWINFO]);
+
+	if (tb[IFLA_GRE_REMOTE]) {
+		struct in6_addr addr;
+		memcpy(&addr, RTA_DATA(tb[IFLA_GRE_REMOTE]), sizeof(addr));
+
+		if (memcmp(&addr, &in6_addr_any, sizeof(addr)))
+			remote = format_host(AF_INET6, sizeof(addr), &addr, s1, sizeof(s1));
+	}
+
+	fprintf(f, "remote %s ", remote);
+
+	if (tb[IFLA_GRE_LOCAL]) {
+		struct in6_addr addr;
+		memcpy(&addr, RTA_DATA(tb[IFLA_GRE_LOCAL]), sizeof(addr));
+
+		if (memcmp(&addr, &in6_addr_any, sizeof(addr)))
+			local = format_host(AF_INET6, sizeof(addr), &addr, s1, sizeof(s1));
+	}
+
+	fprintf(f, "local %s ", local);
+
+	if (tb[IFLA_GRE_LINK] && rta_getattr_u32(tb[IFLA_GRE_LINK])) {
+		unsigned link = rta_getattr_u32(tb[IFLA_GRE_LINK]);
+		const char *n = if_indextoname(link, s2);
+
+		if (n)
+			fprintf(f, "dev %s ", n);
+		else
+			fprintf(f, "dev %u ", link);
+	}
+
+	if (tb[IFLA_GRE_TTL] && rta_getattr_u8(tb[IFLA_GRE_TTL]))
+		fprintf(f, "hoplimit %d ", rta_getattr_u8(tb[IFLA_GRE_TTL]));
+
+	if (flags & IP6_TNL_F_IGN_ENCAP_LIMIT)
+		fprintf(f, "encaplimit none ");
+	else if (tb[IFLA_GRE_ENCAP_LIMIT]) {
+		int encap_limit = rta_getattr_u8(tb[IFLA_GRE_ENCAP_LIMIT]);
+
+		fprintf(f, "encaplimit %d ", encap_limit);
+	}
+	
+	if (flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
+		fprintf(f, "flowlabel inherit ");
+	else
+		fprintf(f, "flowlabel 0x%05x ", ntohl(flowinfo & IP6_FLOWINFO_FLOWLABEL));
+	
+	if (flags & IP6_TNL_F_RCV_DSCP_COPY)
+		fprintf(f, "dscp inherit ");
+
+	if (tb[IFLA_GRE_IFLAGS])
+		iflags = rta_getattr_u16(tb[IFLA_GRE_IFLAGS]);
+
+	if (tb[IFLA_GRE_OFLAGS])
+		oflags = rta_getattr_u16(tb[IFLA_GRE_OFLAGS]);
+
+	if ((iflags & GRE_KEY) && tb[IFLA_GRE_IKEY]) {
+		inet_ntop(AF_INET, RTA_DATA(tb[IFLA_GRE_IKEY]), s2, sizeof(s2));
+		fprintf(f, "ikey %s ", s2);
+	}
+
+	if ((oflags & GRE_KEY) && tb[IFLA_GRE_OKEY]) {
+		inet_ntop(AF_INET, RTA_DATA(tb[IFLA_GRE_OKEY]), s2, sizeof(s2));
+		fprintf(f, "okey %s ", s2);
+	}
+
+	if (iflags & GRE_SEQ)
+		fputs("iseq ", f);
+	if (oflags & GRE_SEQ)
+		fputs("oseq ", f);
+	if (iflags & GRE_CSUM)
+		fputs("icsum ", f);
+	if (oflags & GRE_CSUM)
+		fputs("ocsum ", f);
+}
+
+struct link_util ip6gre_link_util = {
+	.id = "ip6gre",
+	.maxattr = IFLA_GRE_MAX,
+	.parse_opt = gre_parse_opt,
+	.print_opt = gre_print_opt,
+};
+
+struct link_util ip6gretap_link_util = {
+	.id = "ip6gretap",
+	.maxattr = IFLA_GRE_MAX,
+	.parse_opt = gre_parse_opt,
+	.print_opt = gre_print_opt,
+};

RE: GRE support for IPv6

[Templin, Fred L]

> The code compiles cleanly - testing is in progress.

It works.

Fred

> -----Original Message-----
> From: netdev-owner@vger.kernel.org [mailto:netdev-
> owner@vger.kernel.org] On Behalf Of Templin, Fred L
> Sent: Friday, September 13, 2013 3:37 PM
> To: Stephen Hemminger
> Cc: Hannes Frederic Sowa; netdev@vger.kernel.org; xeb@mail.ru
> Subject: RE: GRE support for IPv6
> 
> Hi Stephen,
> 
> See attached for the patches as applied to iproute2-3.10.0.
> The code compiles cleanly - testing is in progress.
> 
> Thanks - Fred
> 
> > -----Original Message-----
> > From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> > Sent: Friday, September 13, 2013 3:06 PM
> > To: Stephen Hemminger
> > Cc: Hannes Frederic Sowa; Templin, Fred L; netdev@vger.kernel.org;
> > xeb@mail.ru
> > Subject: Re: GRE support for IPv6
> >
> > On Fri, 13 Sep 2013 14:46:30 -0700
> > Stephen Hemminger <stephen@networkplumber.org> wrote:
> >
> > > On Fri, 13 Sep 2013 23:01:05 +0200
> > > Hannes Frederic Sowa <hannes@stressinduktion.org> wrote:
> > >
> > > > On Fri, Sep 13, 2013 at 06:32:53PM +0000, Templin, Fred L wrote:
> > > > > Someone recently added the module ./net/ipv6/ip6_gre.c to the
> > > > > kernel, but I cannot find any obvious way to configure it using
> > > > > iproute2. Is there any userland code available for turning on
> > > > > GRE tunnels for IPv6?
> > > >
> > > > I guess it got lost somehow:
> > > >
> > > > http://patchwork.ozlabs.org/patch/173836/
> >
> > That patch is out of date and does not apply cleanly to current
> > iproute2

Re: GRE support for IPv6

[Hannes Frederic Sowa]

Hi Fred!

On Fri, Sep 13, 2013 at 10:37:01PM +0000, Templin, Fred L wrote:
> See attached for the patches as applied to iproute2-3.10.0.
> The code compiles cleanly - testing is in progress.

Could you resend the patches inline (formatted with git-format-patch) so that
patchwork[1] can track them?

[1] http://patchwork.ozlabs.org/project/netdev/list/

Greetings,

  Hannes