Skip to content

Commit 3511494

Browse files
tgrafdavem330
tgraf
authored and
davem330
committed
vxlan: Group Policy extension
Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc. The group membership is defined by the lower 16 bits of skb->mark, the upper 16 bits are used for flags. SELinux allows to manage label to secure local resources. However, distributed applications require ACLs to implemented across hosts. This is typically achieved by matching on L2-L4 fields to identify the original sending host and process on the receiver. On top of that, netlabel and specifically CIPSO [1] allow to map security contexts to universal labels. However, netlabel and CIPSO are relatively complex. This patch provides a lightweight alternative for overlay network environments with a trusted underlay. No additional control protocol is required. Host 1: Host 2: Group A Group B Group B Group A +-----+ +-------------+ +-------+ +-----+ | lxc | | SELinux CTX | | httpd | | VM | +--+--+ +--+----------+ +---+---+ +--+--+ \---+---/ \----+---/ | | +---+---+ +---+---+ | vxlan | | vxlan | +---+---+ +---+---+ +------------------------------+ Backwards compatibility: A VXLAN-GBP socket can receive standard VXLAN frames and will assign the default group 0x0000 to such frames. A Linux VXLAN socket will drop VXLAN-GBP frames. The extension is therefore disabled by default and needs to be specifically enabled: ip link add [...] type vxlan [...] gbp In a mixed environment with VXLAN and VXLAN-GBP sockets, the GBP socket must run on a separate port number. Examples: iptables: host1# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200 host2# iptables -I INPUT -m mark --mark 0x200 -j DROP OVS: # ovs-ofctl add-flow br0 'in_port=1,actions=load:0x200->NXM_NX_TUN_GBP_ID[],NORMAL' # ovs-ofctl add-flow br0 'in_port=2,tun_gbp_id=0x200,actions=drop' [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy [1] http://lwn.net/Articles/204905/ Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 3f3558b commit 3511494

File tree

4 files changed

+152
-21
lines changed

4 files changed

+152
-21
lines changed

‎drivers/net/vxlan.c‎

Lines changed: 71 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -620,7 +620,8 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head,
620620
continue;
621621

622622
vh2 = (struct vxlanhdr *)(p->data + off_vx);
623-
if (vh->vx_vni != vh2->vx_vni) {
623+
if (vh->vx_flags != vh2->vx_flags ||
624+
vh->vx_vni != vh2->vx_vni) {
624625
NAPI_GRO_CB(p)->same_flow = 0;
625626
continue;
626627
}
@@ -1183,6 +1184,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
11831184
struct vxlan_sock *vs;
11841185
struct vxlanhdr *vxh;
11851186
u32 flags, vni;
1187+
struct vxlan_metadata md = {0};
11861188

11871189
/* Need Vxlan and inner Ethernet header to be present */
11881190
if (!pskb_may_pull(skb, VXLAN_HLEN))
@@ -1216,6 +1218,24 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
12161218
vni &= VXLAN_VID_MASK;
12171219
}
12181220

1221+
/* For backwards compatibility, only allow reserved fields to be
1222+
* used by VXLAN extensions if explicitly requested.
1223+
*/
1224+
if ((flags & VXLAN_HF_GBP) && (vs->flags & VXLAN_F_GBP)) {
1225+
struct vxlanhdr_gbp *gbp;
1226+
1227+
gbp = (struct vxlanhdr_gbp *)vxh;
1228+
md.gbp = ntohs(gbp->policy_id);
1229+
1230+
if (gbp->dont_learn)
1231+
md.gbp |= VXLAN_GBP_DONT_LEARN;
1232+
1233+
if (gbp->policy_applied)
1234+
md.gbp |= VXLAN_GBP_POLICY_APPLIED;
1235+
1236+
flags &= ~VXLAN_GBP_USED_BITS;
1237+
}
1238+
12191239
if (flags || (vni & ~VXLAN_VID_MASK)) {
12201240
/* If there are any unprocessed flags remaining treat
12211241
* this as a malformed packet. This behavior diverges from
@@ -1229,7 +1249,8 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
12291249
goto bad_flags;
12301250
}
12311251

1232-
vs->rcv(vs, skb, vxh->vx_vni);
1252+
md.vni = vxh->vx_vni;
1253+
vs->rcv(vs, skb, &md);
12331254
return 0;
12341255

12351256
drop:
@@ -1246,8 +1267,8 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
12461267
return 1;
12471268
}
12481269

1249-
static void vxlan_rcv(struct vxlan_sock *vs,
1250-
struct sk_buff *skb, __be32 vx_vni)
1270+
static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
1271+
struct vxlan_metadata *md)
12511272
{
12521273
struct iphdr *oip = NULL;
12531274
struct ipv6hdr *oip6 = NULL;
@@ -1258,7 +1279,7 @@ static void vxlan_rcv(struct vxlan_sock *vs,
12581279
int err = 0;
12591280
union vxlan_addr *remote_ip;
12601281

1261-
vni = ntohl(vx_vni) >> 8;
1282+
vni = ntohl(md->vni) >> 8;
12621283
/* Is this VNI defined? */
12631284
vxlan = vxlan_vs_find_vni(vs, vni);
12641285
if (!vxlan)
@@ -1292,6 +1313,7 @@ static void vxlan_rcv(struct vxlan_sock *vs,
12921313
goto drop;
12931314

12941315
skb_reset_network_header(skb);
1316+
skb->mark = md->gbp;
12951317

12961318
if (oip6)
12971319
err = IP6_ECN_decapsulate(oip6, skb);
@@ -1641,13 +1663,30 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
16411663
return false;
16421664
}
16431665

1666+
static void vxlan_build_gbp_hdr(struct vxlanhdr *vxh, struct vxlan_sock *vs,
1667+
struct vxlan_metadata *md)
1668+
{
1669+
struct vxlanhdr_gbp *gbp;
1670+
1671+
gbp = (struct vxlanhdr_gbp *)vxh;
1672+
vxh->vx_flags |= htonl(VXLAN_HF_GBP);
1673+
1674+
if (md->gbp & VXLAN_GBP_DONT_LEARN)
1675+
gbp->dont_learn = 1;
1676+
1677+
if (md->gbp & VXLAN_GBP_POLICY_APPLIED)
1678+
gbp->policy_applied = 1;
1679+
1680+
gbp->policy_id = htons(md->gbp & VXLAN_GBP_ID_MASK);
1681+
}
1682+
16441683
#if IS_ENABLED(CONFIG_IPV6)
16451684
static int vxlan6_xmit_skb(struct vxlan_sock *vs,
16461685
struct dst_entry *dst, struct sk_buff *skb,
16471686
struct net_device *dev, struct in6_addr *saddr,
16481687
struct in6_addr *daddr, __u8 prio, __u8 ttl,
1649-
__be16 src_port, __be16 dst_port, __be32 vni,
1650-
bool xnet)
1688+
__be16 src_port, __be16 dst_port,
1689+
struct vxlan_metadata *md, bool xnet)
16511690
{
16521691
struct vxlanhdr *vxh;
16531692
int min_headroom;
@@ -1696,7 +1735,7 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
16961735

16971736
vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
16981737
vxh->vx_flags = htonl(VXLAN_HF_VNI);
1699-
vxh->vx_vni = vni;
1738+
vxh->vx_vni = md->vni;
17001739

17011740
if (type & SKB_GSO_TUNNEL_REMCSUM) {
17021741
u32 data = (skb_checksum_start_offset(skb) - hdrlen) >>
@@ -1714,6 +1753,9 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
17141753
}
17151754
}
17161755

1756+
if (vs->flags & VXLAN_F_GBP)
1757+
vxlan_build_gbp_hdr(vxh, vs, md);
1758+
17171759
skb_set_inner_protocol(skb, htons(ETH_P_TEB));
17181760

17191761
udp_tunnel6_xmit_skb(vs->sock, dst, skb, dev, saddr, daddr, prio,
@@ -1728,7 +1770,8 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
17281770
int vxlan_xmit_skb(struct vxlan_sock *vs,
17291771
struct rtable *rt, struct sk_buff *skb,
17301772
__be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
1731-
__be16 src_port, __be16 dst_port, __be32 vni, bool xnet)
1773+
__be16 src_port, __be16 dst_port,
1774+
struct vxlan_metadata *md, bool xnet)
17321775
{
17331776
struct vxlanhdr *vxh;
17341777
int min_headroom;
@@ -1771,7 +1814,7 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
17711814

17721815
vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
17731816
vxh->vx_flags = htonl(VXLAN_HF_VNI);
1774-
vxh->vx_vni = vni;
1817+
vxh->vx_vni = md->vni;
17751818

17761819
if (type & SKB_GSO_TUNNEL_REMCSUM) {
17771820
u32 data = (skb_checksum_start_offset(skb) - hdrlen) >>
@@ -1789,6 +1832,9 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
17891832
}
17901833
}
17911834

1835+
if (vs->flags & VXLAN_F_GBP)
1836+
vxlan_build_gbp_hdr(vxh, vs, md);
1837+
17921838
skb_set_inner_protocol(skb, htons(ETH_P_TEB));
17931839

17941840
return udp_tunnel_xmit_skb(vs->sock, rt, skb, src, dst, tos,
@@ -1849,6 +1895,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
18491895
const struct iphdr *old_iph;
18501896
struct flowi4 fl4;
18511897
union vxlan_addr *dst;
1898+
struct vxlan_metadata md;
18521899
__be16 src_port = 0, dst_port;
18531900
u32 vni;
18541901
__be16 df = 0;
@@ -1919,11 +1966,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
19191966

19201967
tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
19211968
ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
1969+
md.vni = htonl(vni << 8);
1970+
md.gbp = skb->mark;
19221971

19231972
err = vxlan_xmit_skb(vxlan->vn_sock, rt, skb,
19241973
fl4.saddr, dst->sin.sin_addr.s_addr,
1925-
tos, ttl, df, src_port, dst_port,
1926-
htonl(vni << 8),
1974+
tos, ttl, df, src_port, dst_port, &md,
19271975
!net_eq(vxlan->net, dev_net(vxlan->dev)));
19281976
if (err < 0) {
19291977
/* skb is already freed. */
@@ -1976,10 +2024,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
19762024
}
19772025

19782026
ttl = ttl ? : ip6_dst_hoplimit(ndst);
2027+
md.vni = htonl(vni << 8);
2028+
md.gbp = skb->mark;
19792029

19802030
err = vxlan6_xmit_skb(vxlan->vn_sock, ndst, skb,
19812031
dev, &fl6.saddr, &fl6.daddr, 0, ttl,
1982-
src_port, dst_port, htonl(vni << 8),
2032+
src_port, dst_port, &md,
19832033
!net_eq(vxlan->net, dev_net(vxlan->dev)));
19842034
#endif
19852035
}
@@ -2382,6 +2432,7 @@ static const struct nla_policy vxlan_policy[IFLA_VXLAN_MAX + 1] = {
23822432
[IFLA_VXLAN_UDP_ZERO_CSUM6_RX] = { .type = NLA_U8 },
23832433
[IFLA_VXLAN_REMCSUM_TX] = { .type = NLA_U8 },
23842434
[IFLA_VXLAN_REMCSUM_RX] = { .type = NLA_U8 },
2435+
[IFLA_VXLAN_GBP] = { .type = NLA_FLAG, },
23852436
};
23862437

23872438
static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -2706,6 +2757,9 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
27062757
nla_get_u8(data[IFLA_VXLAN_REMCSUM_RX]))
27072758
vxlan->flags |= VXLAN_F_REMCSUM_RX;
27082759

2760+
if (data[IFLA_VXLAN_GBP])
2761+
vxlan->flags |= VXLAN_F_GBP;
2762+
27092763
if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
27102764
vxlan->dst_port)) {
27112765
pr_info("duplicate VNI %u\n", vni);
@@ -2851,6 +2905,10 @@ static int vxlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
28512905
if (nla_put(skb, IFLA_VXLAN_PORT_RANGE, sizeof(ports), &ports))
28522906
goto nla_put_failure;
28532907

2908+
if (vxlan->flags & VXLAN_F_GBP &&
2909+
nla_put_flag(skb, IFLA_VXLAN_GBP))
2910+
goto nla_put_failure;
2911+
28542912
return 0;
28552913

28562914
nla_put_failure:

‎include/net/vxlan.h‎

Lines changed: 74 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,76 @@
1111
#define VNI_HASH_BITS 10
1212
#define VNI_HASH_SIZE (1<<VNI_HASH_BITS)
1313

14-
/* VXLAN protocol header */
14+
/*
15+
* VXLAN Group Based Policy Extension:
16+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
17+
* |1|-|-|-|1|-|-|-|R|D|R|R|A|R|R|R| Group Policy ID |
18+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
19+
* | VXLAN Network Identifier (VNI) | Reserved |
20+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
21+
*
22+
* D = Don't Learn bit. When set, this bit indicates that the egress
23+
* VTEP MUST NOT learn the source address of the encapsulated frame.
24+
*
25+
* A = Indicates that the group policy has already been applied to
26+
* this packet. Policies MUST NOT be applied by devices when the
27+
* A bit is set.
28+
*
29+
* [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
30+
*/
31+
struct vxlanhdr_gbp {
32+
__u8 vx_flags;
33+
#ifdef __LITTLE_ENDIAN_BITFIELD
34+
__u8 reserved_flags1:3,
35+
policy_applied:1,
36+
reserved_flags2:2,
37+
dont_learn:1,
38+
reserved_flags3:1;
39+
#elif defined(__BIG_ENDIAN_BITFIELD)
40+
__u8 reserved_flags1:1,
41+
dont_learn:1,
42+
reserved_flags2:2,
43+
policy_applied:1,
44+
reserved_flags3:3;
45+
#else
46+
#error "Please fix <asm/byteorder.h>"
47+
#endif
48+
__be16 policy_id;
49+
__be32 vx_vni;
50+
};
51+
52+
#define VXLAN_GBP_USED_BITS (VXLAN_HF_GBP | 0xFFFFFF)
53+
54+
/* skb->mark mapping
55+
*
56+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
57+
* |R|R|R|R|R|R|R|R|R|D|R|R|A|R|R|R| Group Policy ID |
58+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
59+
*/
60+
#define VXLAN_GBP_DONT_LEARN (BIT(6) << 16)
61+
#define VXLAN_GBP_POLICY_APPLIED (BIT(3) << 16)
62+
#define VXLAN_GBP_ID_MASK (0xFFFF)
63+
64+
/* VXLAN protocol header:
65+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
66+
* |G|R|R|R|I|R|R|C| Reserved |
67+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
68+
* | VXLAN Network Identifier (VNI) | Reserved |
69+
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
70+
*
71+
* G = 1 Group Policy (VXLAN-GBP)
72+
* I = 1 VXLAN Network Identifier (VNI) present
73+
* C = 1 Remote checksum offload (RCO)
74+
*/
1575
struct vxlanhdr {
1676
__be32 vx_flags;
1777
__be32 vx_vni;
1878
};
1979

2080
/* VXLAN header flags. */
21-
#define VXLAN_HF_VNI 0x08000000
22-
#define VXLAN_HF_RCO 0x00200000
81+
#define VXLAN_HF_RCO BIT(24)
82+
#define VXLAN_HF_VNI BIT(27)
83+
#define VXLAN_HF_GBP BIT(31)
2384

2485
/* Remote checksum offload header option */
2586
#define VXLAN_RCO_MASK 0x7f /* Last byte of vni field */
@@ -32,8 +93,14 @@ struct vxlanhdr {
3293
#define VXLAN_VID_MASK (VXLAN_N_VID - 1)
3394
#define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
3495

96+
struct vxlan_metadata {
97+
__be32 vni;
98+
u32 gbp;
99+
};
100+
35101
struct vxlan_sock;
36-
typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb, __be32 key);
102+
typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb,
103+
struct vxlan_metadata *md);
37104

38105
/* per UDP socket information */
39106
struct vxlan_sock {
@@ -60,6 +127,7 @@ struct vxlan_sock {
60127
#define VXLAN_F_UDP_ZERO_CSUM6_RX 0x100
61128
#define VXLAN_F_REMCSUM_TX 0x200
62129
#define VXLAN_F_REMCSUM_RX 0x400
130+
#define VXLAN_F_GBP 0x800
63131

64132
struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
65133
vxlan_rcv_t *rcv, void *data,
@@ -70,7 +138,8 @@ void vxlan_sock_release(struct vxlan_sock *vs);
70138
int vxlan_xmit_skb(struct vxlan_sock *vs,
71139
struct rtable *rt, struct sk_buff *skb,
72140
__be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
73-
__be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
141+
__be16 src_port, __be16 dst_port, struct vxlan_metadata *md,
142+
bool xnet);
74143

75144
static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
76145
netdev_features_t features)

‎include/uapi/linux/if_link.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,7 @@ enum {
372372
IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
373373
IFLA_VXLAN_REMCSUM_TX,
374374
IFLA_VXLAN_REMCSUM_RX,
375+
IFLA_VXLAN_GBP,
375376
__IFLA_VXLAN_MAX
376377
};
377378
#define IFLA_VXLAN_MAX (__IFLA_VXLAN_MAX - 1)

‎net/openvswitch/vport-vxlan.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ static inline struct vxlan_port *vxlan_vport(const struct vport *vport)
5959
}
6060

6161
/* Called with rcu_read_lock and BH disabled. */
62-
static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb, __be32 vx_vni)
62+
static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb,
63+
struct vxlan_metadata *md)
6364
{
6465
struct ovs_tunnel_info tun_info;
6566
struct vport *vport = vs->data;
@@ -68,7 +69,7 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb, __be32 vx_vni)
6869

6970
/* Save outer tunnel values */
7071
iph = ip_hdr(skb);
71-
key = cpu_to_be64(ntohl(vx_vni) >> 8);
72+
key = cpu_to_be64(ntohl(md->vni) >> 8);
7273
ovs_flow_tun_info_init(&tun_info, iph,
7374
udp_hdr(skb)->source, udp_hdr(skb)->dest,
7475
key, TUNNEL_KEY, NULL, 0);
@@ -146,6 +147,7 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
146147
struct vxlan_port *vxlan_port = vxlan_vport(vport);
147148
__be16 dst_port = inet_sk(vxlan_port->vs->sock->sk)->inet_sport;
148149
const struct ovs_key_ipv4_tunnel *tun_key;
150+
struct vxlan_metadata md = {0};
149151
struct rtable *rt;
150152
struct flowi4 fl;
151153
__be16 src_port;
@@ -170,12 +172,13 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
170172
skb->ignore_df = 1;
171173

172174
src_port = udp_flow_src_port(net, skb, 0, 0, true);
175+
md.vni = htonl(be64_to_cpu(tun_key->tun_id) << 8);
173176

174177
err = vxlan_xmit_skb(vxlan_port->vs, rt, skb,
175178
fl.saddr, tun_key->ipv4_dst,
176179
tun_key->ipv4_tos, tun_key->ipv4_ttl, df,
177180
src_port, dst_port,
178-
htonl(be64_to_cpu(tun_key->tun_id) << 8),
181+
&md,
179182
false);
180183
if (err < 0)
181184
ip_rt_put(rt);

0 commit comments

Comments
 (0)