From: Thomas Graf <tgraf@suug•ch>
To: davem@davemloft•net, jesse@nicira•com,
stephen@networkplumber•org, pshelar@nicira•com,
therbert@google•com, alexei.starovoitov@gmail•com,
nicolas.dichtel@6wind•com
Cc: netdev@vger•kernel.org, dev@openvswitch•org
Subject: [PATCH 0/5 net-next v4] VXLAN Group Policy Extension
Date: Tue, 13 Jan 2015 17:20:41 +0100 [thread overview]
Message-ID: <cover.1421165078.git.tgraf@suug.ch> (raw)
Implements supports for the Group Policy VXLAN extension [0] to provide
a lightweight and simple security label mechanism across network peers
based on VXLAN. The security context and associated metadata is mapped
to/from skb->mark. This allows further mapping to a SELinux context
using SECMARK, to implement ACLs directly with nftables, iptables, OVS,
tc, etc.
The extension is disabled by default and should be run on a distinct
port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs
which ignore unknown reserved bits will be able to receive VXLAN-GBP
frames.
Simple usage example:
10.1.1.1:
# ip link add vxlan0 type vxlan id 10 remote 10.1.1.2 gbp
# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200
10.1.1.2:
# ip link add vxlan0 type vxlan id 10 remote 10.1.1.1 gbp
# iptables -I INPUT -m mark --mark 0x200 -j DROP
iproute2 [1] and OVS [2] support will be provided in separate patches.
[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
[1] https://github.com/tgraf/iproute2/tree/vxlan-gbp
[2] https://github.com/tgraf/ovs/tree/vxlan-gbp
Thomas Graf (5):
vxlan: Group Policy extension
vxlan: Only bind to sockets with correct extensions enabled
openvswitch: Rename GENEVE_TUN_OPTS() to TUN_METADATA_OPTS()
openvswitch: Allow for any level of nesting in flow attributes
openvswitch: Support VXLAN Group Policy extension
drivers/net/vxlan.c | 219 ++++++++++++++++++++++--------
include/net/ip_tunnels.h | 5 +-
include/net/vxlan.h | 80 ++++++++++-
include/uapi/linux/if_link.h | 8 ++
include/uapi/linux/openvswitch.h | 11 ++
net/openvswitch/flow.c | 2 +-
net/openvswitch/flow.h | 14 +-
net/openvswitch/flow_netlink.c | 286 ++++++++++++++++++++++++++-------------
net/openvswitch/vport-geneve.c | 15 +-
net/openvswitch/vport-vxlan.c | 91 ++++++++++++-
net/openvswitch/vport-vxlan.h | 11 ++
11 files changed, 567 insertions(+), 175 deletions(-)
create mode 100644 net/openvswitch/vport-vxlan.h
--
1.9.3
next reply other threads:[~2015-01-13 16:20 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-13 16:20 Thomas Graf [this message]
2015-01-13 16:20 ` [PATCH 1/5] vxlan: Group Policy extension Thomas Graf
2015-01-13 16:20 ` [PATCH 2/5] vxlan: Only bind to sockets with correct extensions enabled Thomas Graf
2015-01-13 16:20 ` [PATCH 3/5] openvswitch: Rename GENEVE_TUN_OPTS() to TUN_METADATA_OPTS() Thomas Graf
2015-01-13 16:20 ` [PATCH 4/5] openvswitch: Allow for any level of nesting in flow attributes Thomas Graf
2015-01-13 16:20 ` [PATCH 5/5] openvswitch: Support VXLAN Group Policy extension Thomas Graf
2015-01-14 20:37 ` [PATCH 0/5 net-next v4] VXLAN Group Policy Extension David Miller
2015-01-14 20:57 ` Thomas Graf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1421165078.git.tgraf@suug.ch \
--to=tgraf@suug$(echo .)ch \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=dev@openvswitch$(echo .)org \
--cc=jesse@nicira$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=nicolas.dichtel@6wind$(echo .)com \
--cc=pshelar@nicira$(echo .)com \
--cc=stephen@networkplumber$(echo .)org \
--cc=therbert@google$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox