From patchwork Thu Aug 13 20:59:02 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Ahern X-Patchwork-Id: 507178 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D9720140328 for ; Fri, 14 Aug 2015 07:00:03 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b=FGDiVqXt; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754199AbbHMU75 (ORCPT ); Thu, 13 Aug 2015 16:59:57 -0400 Received: from mail-ig0-f182.google.com ([209.85.213.182]:38365 "EHLO mail-ig0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753756AbbHMU74 (ORCPT ); Thu, 13 Aug 2015 16:59:56 -0400 Received: by igfj19 with SMTP id j19so44905225igf.1 for ; Thu, 13 Aug 2015 13:59:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=31Lz/RZ0HoDLumj0y+r5k6B7UYNCiR1wia49QtoscsU=; b=FGDiVqXt7k4mscvuuKwZsRUwwFxovjBKesFR9SgWtipJjGIyCVus2jXMqErbtethNy UBY8WfVZmwfDJxsizMSuP3NKBoKLuyzqudee9fevQISfAjq5Trd0Yhmr7iXJgRGEb13a A94T5dW21f7DvBq3lcRElhs553fWnAfO+BeJ4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=31Lz/RZ0HoDLumj0y+r5k6B7UYNCiR1wia49QtoscsU=; b=i/chAhCHKkRQiBdOkWTwfHAT41BkteRlV1j4P+sYX4YG4V2w2PAq61EddG5DMY/uJM IHdFhYWkv/Y5AFYHcbeRwgeSclvc4AEZATgTS9LFB9912z1HqIkF0M+cY67uqIODJ00R ZgaEsFsu1qPsc99Y41DZbjKIPdxdESFQ6w5i/d63jNUYTCkLS7NgRcAWkP5mqtf6WwpC SOIBH8RAOYPmErXPJjYoe0SD5jw/FTl0r3t+e6BbPwxfD/Qd1ZBfXG1JDZl6K4Qb3Oc+ i7fZ3m2PjpyRdIbvoW/MKxDY2gWjle4nN5Zr6i44+xct4HNCN8gwFQmlr6jX9Rp4E9Hq ExTg== X-Gm-Message-State: ALoCoQms9BqdWoyt4JD++nvFli1DR7Mn6leon6t9n6Ge2NqdHIsHxEhGinYejgs2z1VMv3siaDJ9 X-Received: by 10.50.12.5 with SMTP id u5mr5063527igb.40.1439499595317; Thu, 13 Aug 2015 13:59:55 -0700 (PDT) Received: from localhost.localdomain (c-174-51-80-140.hsd1.co.comcast.net. [174.51.80.140]) by smtp.googlemail.com with ESMTPSA id l14sm2284155ioe.35.2015.08.13.13.59.53 (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 13 Aug 2015 13:59:54 -0700 (PDT) From: David Ahern To: netdev@vger.kernel.org Cc: shm@cumulusnetworks.com, roopa@cumulusnetworks.com, gospo@cumulusnetworks.com, jtoppins@cumulusnetworks.com, nikolay@cumulusnetworks.com, ddutt@cumulusnetworks.com, hannes@stressinduktion.org, nicolas.dichtel@6wind.com, stephen@networkplumber.org, hadi@mojatatu.com, ebiederm@xmission.com, davem@davemloft.net, svaidya@brocade.com, David Ahern Subject: [PATCH net-next 03/11] net: Use VRF device index for lookups on TX Date: Thu, 13 Aug 2015 14:59:02 -0600 Message-Id: <1439499551-90231-4-git-send-email-dsa@cumulusnetworks.com> X-Mailer: git-send-email 2.3.2 (Apple Git-55) In-Reply-To: <1439499551-90231-1-git-send-email-dsa@cumulusnetworks.com> References: <1439499551-90231-1-git-send-email-dsa@cumulusnetworks.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org As with ingress use the index of VRF master device for route lookups on egress. However, the oif should only be used to direct the lookups to a specific table. Routes in the table are not based on the VRF device but rather interfaces that are part of the VRF so do not consider the oif for lookups within the table. The FLOWI_FLAG_VRFSRC is used to control this latter part. Signed-off-by: Shrijeet Mukherjee Signed-off-by: David Ahern --- include/net/flow.h | 1 + include/net/route.h | 3 +++ net/ipv4/fib_trie.c | 7 +++++-- net/ipv4/icmp.c | 4 ++++ net/ipv4/route.c | 5 +++++ 5 files changed, 18 insertions(+), 2 deletions(-) diff --git a/include/net/flow.h b/include/net/flow.h index 3098ae33a178..f305588fc162 100644 --- a/include/net/flow.h +++ b/include/net/flow.h @@ -33,6 +33,7 @@ struct flowi_common { __u8 flowic_flags; #define FLOWI_FLAG_ANYSRC 0x01 #define FLOWI_FLAG_KNOWN_NH 0x02 +#define FLOWI_FLAG_VRFSRC 0x04 __u32 flowic_secid; struct flowi_tunnel flowic_tun_key; }; diff --git a/include/net/route.h b/include/net/route.h index 2d45f419477f..94189d4bd899 100644 --- a/include/net/route.h +++ b/include/net/route.h @@ -251,6 +251,9 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32 if (inet_sk(sk)->transparent) flow_flags |= FLOWI_FLAG_ANYSRC; + if (netif_index_is_vrf(sock_net(sk), oif)) + flow_flags |= FLOWI_FLAG_VRFSRC; + flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE, protocol, flow_flags, dst, src, dport, sport); } diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 37c4bb89a708..1243c79cb5b0 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1423,8 +1423,11 @@ int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp, nh->nh_flags & RTNH_F_LINKDOWN && !(fib_flags & FIB_LOOKUP_IGNORE_LINKSTATE)) continue; - if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif) - continue; + if (!(flp->flowi4_flags & FLOWI_FLAG_VRFSRC)) { + if (flp->flowi4_oif && + flp->flowi4_oif != nh->nh_oif) + continue; + } if (!(fib_flags & FIB_LOOKUP_NOREF)) atomic_inc(&fi->fib_clntref); diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index c0556f1e4bf0..1164fc4ce3bc 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -96,6 +96,7 @@ #include #include #include +#include /* * Build xmit assembly blocks @@ -425,6 +426,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) fl4.flowi4_mark = mark; fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); fl4.flowi4_proto = IPPROTO_ICMP; + fl4.flowi4_oif = vrf_master_ifindex_rcu(skb->dev) ? : skb->dev->ifindex; security_skb_classify_flow(skb, flowi4_to_flowi(&fl4)); rt = ip_route_output_key(net, &fl4); if (IS_ERR(rt)) @@ -458,6 +460,8 @@ static struct rtable *icmp_route_lookup(struct net *net, fl4->flowi4_proto = IPPROTO_ICMP; fl4->fl4_icmp_type = type; fl4->fl4_icmp_code = code; + fl4->flowi4_oif = vrf_master_ifindex_rcu(skb_in->dev) ? : skb_in->dev->ifindex; + security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); rt = __ip_route_output_key(net, fl4); if (IS_ERR(rt)) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index c26ff1f7067d..2c89d294b669 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -2131,6 +2131,11 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4) fl4->saddr = inet_select_addr(dev_out, 0, RT_SCOPE_HOST); } + if (netif_is_vrf(dev_out) && + !(fl4->flowi4_flags & FLOWI_FLAG_VRFSRC)) { + rth = vrf_dev_get_rth(dev_out); + goto out; + } } if (!fl4->daddr) {