Bug 1459600
| Summary: | ip-link cannot create ip6gretap tunnel with a specified encaplimit | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Eric Garver <egarver> |
| Component: | iproute | Assignee: | Phil Sutter <psutter> |
| Status: | CLOSED ERRATA | QA Contact: | Jaroslav Aster <jaster> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.4 | CC: | atragler, jaster, psutter, rkhan, sukulkar |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | iproute-4.11.0-12.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Cause:
Required code to handle 'encaplimit' option for GRE over IPv6 tunnels was missing.
Consequence:
It was not possible to specify any 'encaplimit' value when creating a GRE over IPv6 tunnel.
Fix:
Required code to parse the option has been added.
Result:
'ip link add' command now correctly parses and evaluates 'encaplimit' option when creating a GRE over IPv6 tunnel.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 14:28:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1470965 | ||
Support has landed upstream.
a11b7b71a6eb ("link_gre6: really support encaplimit option")
Hi Phil,
I can confirm that patch works, but I think it's not perfect :-). You can add nonsense (or value out of the range) as encaplimit parametr and it creates device without any warnings and set encaplimit to zero. At least some warning would be nice.
# ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 encaplimit blablabla
# ip -d link show dev ns_gre0
12: ns_gre0@NONE: <BROADCAST,MULTICAST> mtu 1434 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 5e:30:64:8f:86:c2 brd ff:ff:ff:ff:ff:ff promiscuity 0
ip6gretap remote fc00::100 local fc00::1 hoplimit 64 encaplimit 0 flowlabel 0x00000 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
Hi Jaroslav, (In reply to Jaroslav Aster from comment #4) > I can confirm that patch works, but I think it's not perfect :-). You can > add nonsense (or value out of the range) as encaplimit parametr and it > creates device without any warnings and set encaplimit to zero. At least > some warning would be nice. > > # ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 > encaplimit blablabla > # ip -d link show dev ns_gre0 > 12: ns_gre0@NONE: <BROADCAST,MULTICAST> mtu 1434 qdisc noop state DOWN mode > DEFAULT group default qlen 1000 > link/ether 5e:30:64:8f:86:c2 brd ff:ff:ff:ff:ff:ff promiscuity 0 > ip6gretap remote fc00::100 local fc00::1 hoplimit 64 encaplimit 0 > flowlabel 0x00000 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size > 65536 gso_max_segs 65535 Ah yes, this is definitely a bug. I sent a fix upstream: https://marc.info/?l=linux-netdev&m=151188421619871&w=2 Thanks for the heads-up! Patch got accepted:
commit 56708ae7c9535859223c5b68097b35bf0fae677c
Author: Phil Sutter <phil>
Date: Tue Nov 28 16:49:58 2017 +0100
link_gre6: Detect invalid encaplimit values
Looks like a typo: get_u8() returns 0 on success and -1 on error, so the
error checking here was ineffective.
Fixes: a11b7b71a6eba ("link_gre6: really support encaplimit option")
Signed-off-by: Phil Sutter <phil>
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0815 |
Description of problem: You cannot specify the encaplimit while creating an ip6gretap tunnel even though both the man page and online help suggest you can. The code to parse and set encaplimit is non-existent in ip/link_gre6.c. As such this requires upstream work. Note: iproute2 upstream/master does not have support as of 2017-06-07. Steps to Reproduce: $ sudo ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 encaplimit none Usage: ip link { add | set | change | replace | del } NAME type { ip6gre | ip6gretap } [ remote ADDR ] [ local ADDR ] [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] [ hoplimit TTL ] [ encaplimit ELIM ] [ tclass TCLASS ] [ flowlabel FLOWLABEL ] [ dscp inherit ] [ dev PHYS_DEV ] [ noencap ] [ encap { fou | gue | none } ] [ encap-sport PORT ] [ encap-dport PORT ] [ [no]encap-csum ] [ [no]encap-csum6 ] [ [no]encap-remcsum ] Where: NAME := STRING ADDR := IPV6_ADDRESS TTL := { 0..255 } (default=64) KEY := { DOTTED_QUAD | NUMBER } ELIM := { none | 0..255 }(default=4) TCLASS := { 0x0..0xff | inherit } FLOWLABEL := { 0x0..0xfffff | inherit }