From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Manning Subject: [PATCH net-next v5 0/9] vrf: allow simultaneous service instances in default and other VRFs Date: Wed, 7 Nov 2018 15:36:01 +0000 Message-ID: <20181107153610.7526-1-mmanning@vyatta.att-mail.com> To: netdev@vger.kernel.org Return-path: Received: from mx0b-00191d01.pphosted.com ([67.231.157.136]:47280 "EHLO mx0a-00191d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728098AbeKHBHX (ORCPT ); Wed, 7 Nov 2018 20:07:23 -0500 Received: from pps.filterd (m0049463.ppops.net [127.0.0.1]) by m0049463.ppops.net-00191d01. (8.16.0.22/8.16.0.22) with SMTP id wA7FKPRu043461 for ; Wed, 7 Nov 2018 10:36:30 -0500 Received: from tlpd255.enaf.dadc.sbc.com (sbcsmtp3.sbc.com [144.160.112.28]) by m0049463.ppops.net-00191d01. with ESMTP id 2nm0ktxmc3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 07 Nov 2018 10:36:27 -0500 Received: from enaf.dadc.sbc.com (localhost [127.0.0.1]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id wA7FaPIJ070117 for ; Wed, 7 Nov 2018 09:36:26 -0600 Received: from zlp30493.vci.att.com (zlp30493.vci.att.com [135.46.181.176]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id wA7FaKCP069878 for ; Wed, 7 Nov 2018 09:36:20 -0600 Received: from zlp30493.vci.att.com (zlp30493.vci.att.com [127.0.0.1]) by zlp30493.vci.att.com (Service) with ESMTP id DD13D40470D9 for ; Wed, 7 Nov 2018 15:36:20 +0000 (GMT) Received: from tlpd252.dadc.sbc.com (unknown [135.31.184.157]) by zlp30493.vci.att.com (Service) with ESMTP id B7B0A40470D5 for ; Wed, 7 Nov 2018 15:36:20 +0000 (GMT) Received: from dadc.sbc.com (localhost [127.0.0.1]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id wA7FaKfQ057536 for ; Wed, 7 Nov 2018 09:36:20 -0600 Received: from mail.eng.vyatta.net (mail.eng.vyatta.net [10.156.50.82]) by tlpd252.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id wA7FaHhG057455 for ; Wed, 7 Nov 2018 09:36:17 -0600 Received: from MM-7520.vyatta.net (unknown [10.156.47.119]) by mail.eng.vyatta.net (Postfix) with ESMTPA id A54F136012A for ; Wed, 7 Nov 2018 07:36:16 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: Services currently have to be VRF-aware if they are using an unbound socket. One cannot have multiple service instances running in the default and other VRFs for services that are not VRF-aware and listen on an unbound socket. This is because there is no easy way of isolating packets received in the default VRF from those arriving in other VRFs. This series provides this isolation for stream sockets subject to the existing kernel parameter net.ipv4.tcp_l3mdev_accept not being set, given that this is documented as allowing a single service instance to work across all VRF domains. Similarly, net.ipv4.udp_l3mdev_accept is checked for datagram sockets, and net.ipv4.raw_l3mdev_accept is introduced for raw sockets. The functionality applies to UDP & TCP services as well as those using raw sockets, and is for IPv4 and IPv6. Example of running ssh instances in default and blue VRF: $ /usr/sbin/sshd -D $ ip vrf exec vrf-blue /usr/sbin/sshd $ ss -ta | egrep 'State|ssh' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0%vrf-blue:ssh 0.0.0.0:* LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* ESTAB 0 0 192.168.122.220:ssh 192.168.122.1:50282 LISTEN 0 128 [::]%vrf-blue:ssh [::]:* LISTEN 0 128 [::]:ssh [::]:* ESTAB 0 0 [3000::2]%vrf-blue:ssh [3000::9]:45896 ESTAB 0 0 [2000::2]:ssh [2000::9]:46398 v1: - Address Paolo Abeni's comments (patch 4/5) - Fix build when CONFIG_NET_L3_MASTER_DEV not defined (patch 1/5) v2: - Address David Aherns' comments (patches 4/5 and 5/5) - Remove patches 3/5 and 5/5 from series for individual submissions - Include a sysctl for raw sockets as recommended by David Ahern - Expand series into 10 patches and provide improved descriptions v3: - Update description for patch 1/10 and remove patch 6/10 v4: - Set default to enabled for raw socket sysctl as recommended by David Ahern v5: - Address review comments from David Ahern in patches 2-5 Dewi Morgan (1): ipv6: do not drop vrf udp multicast packets Duncan Eastoe (1): net: fix raw socket lookup device bind matching with VRFs Mike Manning (6): net: ensure unbound stream socket to be chosen when not in a VRF net: ensure unbound datagram socket to be chosen when not in a VRF net: provide a sysctl raw_l3mdev_accept for raw socket lookup with VRFs vrf: mark skb for multicast or link-local as enslaved to VRF ipv6: allow ping to link-local address in VRF ipv6: handling of multicast packets received in VRF Robert Shearman (1): net: allow binding socket in a VRF when there's an unbound socket Documentation/networking/ip-sysctl.txt | 12 ++++++++++++ Documentation/networking/vrf.txt | 22 +++++++++++++++++---- drivers/net/vrf.c | 19 +++++++++--------- include/net/inet6_hashtables.h | 5 ++--- include/net/inet_hashtables.h | 24 ++++++++++++++++------- include/net/inet_sock.h | 21 ++++++++++++++++++++ include/net/netns/ipv4.h | 3 +++ include/net/raw.h | 14 +++++++++++++- include/net/udp.h | 11 +++++++++++ net/core/sock.c | 2 ++ net/ipv4/af_inet.c | 2 ++ net/ipv4/inet_connection_sock.c | 13 ++++++++++--- net/ipv4/inet_hashtables.c | 34 ++++++++++++++++++++------------- net/ipv4/raw.c | 31 ++++++++++++++++++++++++++---- net/ipv4/sysctl_net_ipv4.c | 11 +++++++++++ net/ipv4/udp.c | 15 ++++++--------- net/ipv6/datagram.c | 10 +++++++--- net/ipv6/inet6_hashtables.c | 14 ++++++-------- net/ipv6/ip6_input.c | 35 +++++++++++++++++++++++++++++++--- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/raw.c | 5 ++--- net/ipv6/udp.c | 22 ++++++++++----------- 22 files changed, 243 insertions(+), 84 deletions(-) -- 2.11.0