diff options
| author | David S. Miller <[email protected]> | 2015-01-15 01:12:13 -0500 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2015-01-15 01:12:13 -0500 |
| commit | 2e62fa699ffb3f5b3a6778c720818e95690e9faa (patch) | |
| tree | d5442581624a3ff7f3b4d91d193ba5928cc98328 /net/openvswitch/flow.c | |
| parent | 3f3558bb512e0762d5a4573a4aaf038d7a616e92 (diff) | |
| parent | 1dd144cf5b4b47e12438c2c6883925ce1a9b499f (diff) | |
Merge branch 'vxlan_group_policy_extension'
Thomas Graf says:
====================
VXLAN Group Policy Extension
Implements supports for the Group Policy VXLAN extension [0] to provide
a lightweight and simple security label mechanism across network peers
based on VXLAN. The security context and associated metadata is mapped
to/from skb->mark. This allows further mapping to a SELinux context
using SECMARK, to implement ACLs directly with nftables, iptables, OVS,
tc, etc.
The extension is disabled by default and should be run on a distinct
port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs
which ignore unknown reserved bits will be able to receive VXLAN-GBP
frames.
Simple usage example:
10.1.1.1:
# ip link add vxlan0 type vxlan id 10 remote 10.1.1.2 gbp
# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200
10.1.1.2:
# ip link add vxlan0 type vxlan id 10 remote 10.1.1.1 gbp
# iptables -I INPUT -m mark --mark 0x200 -j DROP
iproute2 [1] and OVS [2] support will be provided in separate patches.
[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
[1] https://github.com/tgraf/iproute2/tree/vxlan-gbp
[2] https://github.com/tgraf/ovs/tree/vxlan-gbp
====================
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/openvswitch/flow.c')
| -rw-r--r-- | net/openvswitch/flow.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c index df334fe43d7f..e2c348b8baca 100644 --- a/net/openvswitch/flow.c +++ b/net/openvswitch/flow.c @@ -691,7 +691,7 @@ int ovs_flow_key_extract(const struct ovs_tunnel_info *tun_info, BUILD_BUG_ON((1 << (sizeof(tun_info->options_len) * 8)) - 1 > sizeof(key->tun_opts)); - memcpy(GENEVE_OPTS(key, tun_info->options_len), + memcpy(TUN_METADATA_OPTS(key, tun_info->options_len), tun_info->options, tun_info->options_len); key->tun_opts_len = tun_info->options_len; } else { |