The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear
at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.40
------>
commit c1d5c0fffabc61269da7be8bf91894b6e673ce1e
Author: Kirill Gorkunov <gorcu...@virtuozzo.com>
Date: Fri Jun 11 15:08:02 2021 +0300
net/gre: Consider VE_FEATURE_IPGRE on new net creation
If we load gre module on the node, say we need gre transport on the
node for some reason, this will affect containers -- they won't be
checkpointable (due to lack of support in userspace) until the module
is unloaded from the node again. We have a special feature bit to
control this tansport creation, lets start consideing its value.
https://jira.sw.ru/browse/PSBM-84241
Signed-off-by: Cyrill Gorcunov <gorcu...@virtuozzo.com>
Rebased to vz8:
- With ms commit 64bc17811b72 ("ipv4: speedup ipv6 tunnels dismantle")
tunnels started to use ops->exit_batch with ip_tunnel_delete_nets
instead of ip_tunnel_delete_net and ops->exit, which this commit modified
With rebase commit 70e5af2252244 ("net: Make ipip feature optional")
ip_tunnel_delete_nets is aware of itn being NULL in some net namespaces.
So we can safely drop op->exit hunks.
- Use net_generic_free instead of net_assign_generic for the same reasons
as 70e5af2252244 ("net: Make ipip feature optional")
(cherry-picked from vz7 commit 2db99ab7bfe2 ("net/gre: Consider
VE_FEATURE_IPGRE
on new net creation"))
Signed-off-by: Andrey Zhadchenko <andrey.zhadche...@virtuozzo.com>
---
include/uapi/linux/vzcalluser.h | 2 +-
net/ipv4/ip_gre.c | 20 ++++++++++++++++++++
net/ipv4/ip_tunnel.c | 4 ++++
net/ipv6/ip6_gre.c | 23 +++++++++++++++++++++++
4 files changed, 48 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/vzcalluser.h b/include/uapi/linux/vzcalluser.h
index 8a4ff0015e40..a7f7268bdd80 100644
--- a/include/uapi/linux/vzcalluser.h
+++ b/include/uapi/linux/vzcalluser.h
@@ -42,7 +42,7 @@ struct vzctl_ve_configure {
#define VE_FEATURE_SIT (1ULL << 3)
#define VE_FEATURE_IPIP (1ULL << 4)
#define VE_FEATURE_PPP (1ULL << 5)
-#define VE_FEATURE_IPGRE (1ULL << 6) /* deprecated */
+#define VE_FEATURE_IPGRE (1ULL << 6)
#define VE_FEATURE_BRIDGE (1ULL << 7)
#define VE_FEATURE_NFSD (1ULL << 8)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 16f0c2cbf884..5bd4892cd75c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -50,6 +50,9 @@
#include <net/dst_metadata.h>
#include <net/erspan.h>
+#include <uapi/linux/vzcalluser.h>
+#include <linux/ve.h>
+
/*
Problems & solutions
--------------------
@@ -982,6 +985,12 @@ static const struct gre_protocol ipgre_protocol = {
static int __net_init ipgre_init_net(struct net *net)
{
+#ifdef CONFIG_VE
+ if (!(net->owner_ve->features & VE_FEATURE_IPGRE)) {
+ net_generic_free(net, ipgre_net_id);
+ return 0;
+ }
+#endif
return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL);
}
@@ -1280,6 +1289,11 @@ static int ipgre_newlink(struct net *src_net, struct
net_device *dev,
__u32 fwmark = 0;
int err;
+#ifdef CONFIG_VE
+ if (!(dev_net(dev)->owner_ve->features & VE_FEATURE_IPGRE))
+ return -EACCES;
+#endif
+
if (ipgre_netlink_encap_parms(data, &ipencap)) {
struct ip_tunnel *t = netdev_priv(dev);
err = ip_tunnel_encap_setup(t, &ipencap);
@@ -1568,6 +1582,12 @@ EXPORT_SYMBOL_GPL(gretap_fb_dev_create);
static int __net_init ipgre_tap_init_net(struct net *net)
{
+#ifdef CONFIG_VE
+ if (!(net->owner_ve->features & VE_FEATURE_IPGRE)) {
+ net_generic_free(net, gre_tap_net_id);
+ return 0;
+ }
+#endif
return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops,
"gretap0");
}
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index f57cb3f9e866..fdb618605083 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -103,6 +103,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net
*itn,
struct net_device *ndev;
unsigned int hash;
+#ifdef CONFIG_VE
+ if (!itn) /* no VE_FEATURE_IPGRE */
+ return NULL;
+#endif
hash = ip_tunnel_hash(key, remote);
head = &itn->tunnels[hash];
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 114455044b6d..015038b4bf4a 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -58,6 +58,7 @@
#include <net/erspan.h>
#include <net/dst_metadata.h>
+#include <uapi/linux/vzcalluser.h>
static bool log_ecn_error = true;
module_param(log_ecn_error, bool, 0644);
@@ -134,6 +135,11 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct
net_device *dev,
int score, cand_score = 4;
struct net_device *ndev;
+#ifdef CONFIG_VE
+ if (!ign) /* no VE_FEATURE_IPGRE */
+ return NULL;
+#endif
+
for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
if (!ipv6_addr_equal(local, &t->parms.laddr) ||
!ipv6_addr_equal(remote, &t->parms.raddr) ||
@@ -1536,6 +1542,11 @@ static void ip6gre_destroy_tunnels(struct net *net,
struct list_head *head)
struct net_device *dev, *aux;
int prio;
+#ifdef CONFIG_VE
+ if (!ign) /* no VE_FEATURE_IPGRE */
+ return;
+#endif
+
for_each_netdev_safe(net, dev, aux)
if (dev->rtnl_link_ops == &ip6gre_link_ops ||
dev->rtnl_link_ops == &ip6gre_tap_ops ||
@@ -1568,6 +1579,13 @@ static int __net_init ip6gre_init_net(struct net *net)
struct net_device *ndev;
int err;
+#ifdef CONFIG_VE
+ if (!(net->owner_ve->features & VE_FEATURE_IPGRE)) {
+ net_generic_free(net, ip6gre_net_id);
+ return 0;
+ }
+#endif
+
if (!net_has_fallback_tunnels(net))
return 0;
ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
@@ -1949,6 +1967,11 @@ static int ip6gre_newlink_common(struct net *src_net,
struct net_device *dev,
struct ip_tunnel_encap ipencap;
int err;
+#ifdef CONFIG_VE
+ if (!ign) /* no VE_FEATURE_IPGRE */
+ return -EACCES;
+#endif
+
nt = netdev_priv(dev);
if (ip6gre_netlink_encap_parms(data, &ipencap)) {
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
