public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

From: David Ahern <dsa@cumulusnetworks•com>
To: Steffen Klassert <steffen.klassert@secunet•com>
Cc: netdev@vger•kernel.org, herbert@gondor•apana.org.au, davem@davemloft•net
Subject: Re: [PATCH] xfrm: Add oif to dst lookups
Date: Tue, 15 Sep 2015 07:47:20 -0600	[thread overview]
Message-ID: <55F82168.5080304@cumulusnetworks.com> (raw)
In-Reply-To: <20150915092838.GK25499@secunet.com>

Hi Steffen:

On 9/15/15 3:28 AM, Steffen Klassert wrote:
> On Mon, Aug 10, 2015 at 04:58:11PM -0600, David Ahern wrote:
>> Rules can be installed that direct route lookups to specific tables based
>> on oif. Plumb the oif through the xfrm lookups so it gets set in the flow
>> struct and passed to the resolver routines.
>>
>> Signed-off-by: David Ahern <dsa@cumulusnetworks•com>
>
> David, this change broke vti tunnels.
>
>> @@ -1690,8 +1694,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
>>
>>   		if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
>>   			family = xfrm[i]->props.family;
>> -			dst = xfrm_dst_lookup(xfrm[i], tos, &saddr, &daddr,
>> -					      family);
>> +			dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
>> +					      &saddr, &daddr, family);
>
> Passing the original output interface to xfrm_dst_lookup will generate
> a routing loop whenever the original output interface is not identical
> to the tunnel endpoint, like it is with vti. We can not ask for a route
> through a specific interface here. This is the lookup for the tunnel
> endpoints, so it must return a route through the local tunnel endpoint
> device.
>
> I don't know how you are going to use this with your vrf changes, so
> I'm not sure how to fix this in a way that it works with vrf. Please
> look into this.
>

I wonder if it is failing in fib_table_lookup() at this point:

                                 if (flp->flowi4_oif &&
                                     flp->flowi4_oif != nh->nh_oif)
                                         continue;

(for this case flp->flowi4_flags does not have FLOWI_FLAG_VRFSRC set).

There are FIB tracepoints that would help shed some light, combined with 
a probe on exit:

perf probe -a 'fib_table_lookup_ret=fib_table_lookup%return ret=%ax'
perf record -e fib:* -e probe:* -a
perf script

I have not used VTI mode before. I'll look into it today. If possible 
can you send me config commands to reproduce?

Thanks,
David

     prev parent reply	other threads:[~2015-09-15 13:47 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-08-10 22:58 [PATCH] xfrm: Add oif to dst lookups David Ahern
2015-08-12 10:26 ` Steffen Klassert
2015-09-15  9:28 ` Steffen Klassert
2015-09-15 13:47   ` David Ahern [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=55F82168.5080304@cumulusnetworks.com \
    --to=dsa@cumulusnetworks$(echo .)com \
    --cc=davem@davemloft$(echo .)net \
    --cc=herbert@gondor$(echo .)apana.org.au \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=steffen.klassert@secunet$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox