Red Hat Bugzilla – Bug 1459600
ip-link cannot create ip6gretap tunnel with a specified encaplimit
Last modified: 2018-04-10 10:30:43 EDT
Description of problem: You cannot specify the encaplimit while creating an ip6gretap tunnel even though both the man page and online help suggest you can. The code to parse and set encaplimit is non-existent in ip/link_gre6.c. As such this requires upstream work. Note: iproute2 upstream/master does not have support as of 2017-06-07. Steps to Reproduce: $ sudo ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 encaplimit none Usage: ip link { add | set | change | replace | del } NAME type { ip6gre | ip6gretap } [ remote ADDR ] [ local ADDR ] [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] [ hoplimit TTL ] [ encaplimit ELIM ] [ tclass TCLASS ] [ flowlabel FLOWLABEL ] [ dscp inherit ] [ dev PHYS_DEV ] [ noencap ] [ encap { fou | gue | none } ] [ encap-sport PORT ] [ encap-dport PORT ] [ [no]encap-csum ] [ [no]encap-csum6 ] [ [no]encap-remcsum ] Where: NAME := STRING ADDR := IPV6_ADDRESS TTL := { 0..255 } (default=64) KEY := { DOTTED_QUAD | NUMBER } ELIM := { none | 0..255 }(default=4) TCLASS := { 0x0..0xff | inherit } FLOWLABEL := { 0x0..0xfffff | inherit }
Support has landed upstream. a11b7b71a6eb ("link_gre6: really support encaplimit option")
Hi Phil, I can confirm that patch works, but I think it's not perfect :-). You can add nonsense (or value out of the range) as encaplimit parametr and it creates device without any warnings and set encaplimit to zero. At least some warning would be nice. # ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 encaplimit blablabla # ip -d link show dev ns_gre0 12: ns_gre0@NONE: <BROADCAST,MULTICAST> mtu 1434 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 5e:30:64:8f:86:c2 brd ff:ff:ff:ff:ff:ff promiscuity 0 ip6gretap remote fc00::100 local fc00::1 hoplimit 64 encaplimit 0 flowlabel 0x00000 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
Hi Jaroslav, (In reply to Jaroslav Aster from comment #4) > I can confirm that patch works, but I think it's not perfect :-). You can > add nonsense (or value out of the range) as encaplimit parametr and it > creates device without any warnings and set encaplimit to zero. At least > some warning would be nice. > > # ip link add dev ns_gre0 type ip6gretap remote fc00::100 local fc00::1 > encaplimit blablabla > # ip -d link show dev ns_gre0 > 12: ns_gre0@NONE: <BROADCAST,MULTICAST> mtu 1434 qdisc noop state DOWN mode > DEFAULT group default qlen 1000 > link/ether 5e:30:64:8f:86:c2 brd ff:ff:ff:ff:ff:ff promiscuity 0 > ip6gretap remote fc00::100 local fc00::1 hoplimit 64 encaplimit 0 > flowlabel 0x00000 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size > 65536 gso_max_segs 65535 Ah yes, this is definitely a bug. I sent a fix upstream: https://marc.info/?l=linux-netdev&m=151188421619871&w=2 Thanks for the heads-up!
Patch got accepted: commit 56708ae7c9535859223c5b68097b35bf0fae677c Author: Phil Sutter <phil@nwl.cc> Date: Tue Nov 28 16:49:58 2017 +0100 link_gre6: Detect invalid encaplimit values Looks like a typo: get_u8() returns 0 on success and -1 on error, so the error checking here was ineffective. Fixes: a11b7b71a6eba ("link_gre6: really support encaplimit option") Signed-off-by: Phil Sutter <phil@nwl.cc>
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0815