From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Wed, 12 Aug 2026 15:03:56 +0200 Subject: [Devel] [PATCH DRAFT vz10 0/5] Enable GRE ERSPAN inside Containers Message-ID: <20260812130401.154702-1-khorenko@virtuozzo.com> List-Id: Currently ERSPAN is compiled out under CONFIG_VE by commit a6adc8063402 ("ve/net/gre: Disable ERSPAN support in ip_gre module"), because at the time it was not wired into the per-Container GRE infrastructure. This series reverts that stub-out and integrates ERSPAN into the Container framework for both IPv4 and IPv6, gated by a new VE_FEATURE_ERSPAN bit, and fixes a couple of pre-existing defects in the IPv6 GRE containerization found along the way. ERSPAN is a Cisco traffic-mirroring protocol layered on GRE. It is a separate device type from ip_gre/gretap, so it gets its own feature bit rather than reusing VE_FEATURE_IPGRE. Like the other tunnel features it is disabled by default for Containers (VE_FEATURES_DEF) and enabled for the host (init_ve has all features set), so host behaviour is unchanged. The series is arranged so that the pre-existing bug fixes are separate, self-contained and backportable, with proper Fixes: tags: Feature work: 1 Revert the CONFIG_VE stub-out of ERSPAN. 2 IPv4: enable erspan in a CT under VE_FEATURE_ERSPAN (NETIF_F_VIRTUAL on the device, per-net gating, -EACCES on newlink/changelink when the feature is off). 5 IPv6: enable ip6erspan under VE_FEATURE_ERSPAN. ip6erspan shares the per-net state with ip6gre/ip6gretap, so the shared ign is allocated when either VE_FEATURE_IPGRE or VE_FEATURE_ERSPAN is set and each rtnl op checks its own bit. Pre-existing fixes (IPv6): 3 ip6gretap never set NETIF_F_VIRTUAL, so it could not be created in a CT even with VE_FEATURE_IPGRE. Fixes: 85f1620c362c 4 ip6gre_newlink()/ip6erspan_newlink() dereference the per-net data before the VE_FEATURE_IPGRE guard that lived in newlink_common(); a CT without the feature could NULL-deref and crash the host. Fixes: 1e1433063539 The six rtnl link types handled here (gre, gretap, erspan, ip6gre, ip6gretap, ip6erspan) and the positive/negative test matrix (per-feature gating for IPv4 and IPv6, plus the no-crash check for patch 4) are described in the ticket. Follow-ups tracked there: a vzctl/libvzctl name for the new bit, a dedicated kselftest for the IPGRE/ERSPAN gating, and CRIU support for CT migration with ERSPAN devices. Compile-tested (net/ipv4/ip_gre.o, net/ipv6/ip6_gre.o). Not yet runtime-tested inside a Container. https://virtuozzo.atlassian.net/browse/VSTOR-141173 Konstantin Khorenko (5): Revert "ve/net/gre: Disable ERSPAN support in ip_gre module" ve/net/gre: Enable ERSPAN support in Containers under VE_FEATURE_ERSPAN ve/net/ip6_gre: Mark ip6gretap devices as movable into a Container ve/net/ip6_gre: Fix NULL deref when creating ip6gre/ip6erspan without VE_FEATURE_IPGRE ve/net/ip6_gre: Enable ip6erspan support in Containers under VE_FEATURE_ERSPAN include/uapi/linux/vzcalluser.h | 1 + net/ipv4/ip_gre.c | 59 ++++++++++++++------------------- net/ipv6/ip6_gre.c | 30 +++++++++++------ 3 files changed, 46 insertions(+), 44 deletions(-) -- 2.43.0