[Devel] [PATCH DRAFT vz10 0/5] Enable GRE ERSPAN inside Containers

[Konstantin Khorenko]

Currently ERSPAN is compiled out under CONFIG_VE by commit a6adc8063402
("ve/net/gre: Disable ERSPAN support in ip_gre module"), because at the
time it was not wired into the per-Container GRE infrastructure. This
series reverts that stub-out and integrates ERSPAN into the Container
framework for both IPv4 and IPv6, gated by a new VE_FEATURE_ERSPAN bit,
and fixes a couple of pre-existing defects in the IPv6 GRE
containerization found along the way.

ERSPAN is a Cisco traffic-mirroring protocol layered on GRE. It is a
separate device type from ip_gre/gretap, so it gets its own feature bit
rather than reusing VE_FEATURE_IPGRE. Like the other tunnel features it
is disabled by default for Containers (VE_FEATURES_DEF) and enabled for
the host (init_ve has all features set), so host behaviour is unchanged.

The series is arranged so that the pre-existing bug fixes are separate,
self-contained and backportable, with proper Fixes: tags:

  Feature work:
    1  Revert the CONFIG_VE stub-out of ERSPAN.
    2  IPv4: enable erspan in a CT under VE_FEATURE_ERSPAN
       (NETIF_F_VIRTUAL on the device, per-net gating, -EACCES on
       newlink/changelink when the feature is off).
    5  IPv6: enable ip6erspan under VE_FEATURE_ERSPAN. ip6erspan shares
       the per-net state with ip6gre/ip6gretap, so the shared ign is
       allocated when either VE_FEATURE_IPGRE or VE_FEATURE_ERSPAN is
       set and each rtnl op checks its own bit.

  Pre-existing fixes (IPv6):
    3  ip6gretap never set NETIF_F_VIRTUAL, so it could not be created
       in a CT even with VE_FEATURE_IPGRE.
       Fixes: 85f1620c362c
    4  ip6gre_newlink()/ip6erspan_newlink() dereference the per-net data
       before the VE_FEATURE_IPGRE guard that lived in newlink_common();
       a CT without the feature could NULL-deref and crash the host.
       Fixes: 1e1433063539

The six rtnl link types handled here (gre, gretap, erspan, ip6gre,
ip6gretap, ip6erspan) and the positive/negative test matrix (per-feature
gating for IPv4 and IPv6, plus the no-crash check for patch 4) are
described in the ticket. Follow-ups tracked there: a vzctl/libvzctl name
for the new bit, a dedicated kselftest for the IPGRE/ERSPAN gating, and
CRIU support for CT migration with ERSPAN devices.

Compile-tested (net/ipv4/ip_gre.o, net/ipv6/ip6_gre.o). Not yet
runtime-tested inside a Container.

https://virtuozzo.atlassian.net/browse/VSTOR-141173

Konstantin Khorenko (5):
  Revert "ve/net/gre: Disable ERSPAN support in ip_gre module"
  ve/net/gre: Enable ERSPAN support in Containers under
    VE_FEATURE_ERSPAN
  ve/net/ip6_gre: Mark ip6gretap devices as movable into a Container
  ve/net/ip6_gre: Fix NULL deref when creating ip6gre/ip6erspan without
    VE_FEATURE_IPGRE
  ve/net/ip6_gre: Enable ip6erspan support in Containers under
    VE_FEATURE_ERSPAN

 include/uapi/linux/vzcalluser.h |  1 +
 net/ipv4/ip_gre.c               | 59 ++++++++++++++-------------------
 net/ipv6/ip6_gre.c              | 30 +++++++++++------
 3 files changed, 46 insertions(+), 44 deletions(-)

-- 
2.43.0