linux/net/openvswitch
Thomas Graf 3511494ce2 vxlan: Group Policy extension
Implements supports for the Group Policy VXLAN extension [0] to provide
a lightweight and simple security label mechanism across network peers
based on VXLAN. The security context and associated metadata is mapped
to/from skb->mark. This allows further mapping to a SELinux context
using SECMARK, to implement ACLs directly with nftables, iptables, OVS,
tc, etc.

The group membership is defined by the lower 16 bits of skb->mark, the
upper 16 bits are used for flags.

SELinux allows to manage label to secure local resources. However,
distributed applications require ACLs to implemented across hosts. This
is typically achieved by matching on L2-L4 fields to identify the
original sending host and process on the receiver. On top of that,
netlabel and specifically CIPSO [1] allow to map security contexts to
universal labels.  However, netlabel and CIPSO are relatively complex.
This patch provides a lightweight alternative for overlay network
environments with a trusted underlay. No additional control protocol
is required.

           Host 1:                       Host 2:

      Group A        Group B        Group B     Group A
      +-----+   +-------------+    +-------+   +-----+
      | lxc |   | SELinux CTX |    | httpd |   | VM  |
      +--+--+   +--+----------+    +---+---+   +--+--+
	  \---+---/                     \----+---/
	      |                              |
	  +---+---+                      +---+---+
	  | vxlan |                      | vxlan |
	  +---+---+                      +---+---+
	      +------------------------------+

Backwards compatibility:
A VXLAN-GBP socket can receive standard VXLAN frames and will assign
the default group 0x0000 to such frames. A Linux VXLAN socket will
drop VXLAN-GBP  frames. The extension is therefore disabled by default
and needs to be specifically enabled:

   ip link add [...] type vxlan [...] gbp

In a mixed environment with VXLAN and VXLAN-GBP sockets, the GBP socket
must run on a separate port number.

Examples:
 iptables:
  host1# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200
  host2# iptables -I INPUT -m mark --mark 0x200 -j DROP

 OVS:
  # ovs-ofctl add-flow br0 'in_port=1,actions=load:0x200->NXM_NX_TUN_GBP_ID[],NORMAL'
  # ovs-ofctl add-flow br0 'in_port=2,tun_gbp_id=0x200,actions=drop'

[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
[1] http://lwn.net/Articles/204905/

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15 01:11:41 -05:00
..
actions.c net: rename vlan_tx_* helpers since "tx" is misleading there 2015-01-13 17:51:08 -05:00
datapath.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-01-15 00:53:17 -05:00
datapath.h openvswitch: Add support for OVS_FLOW_ATTR_PROBE. 2014-11-09 18:58:44 -08:00
dp_notify.c genetlink: make multicast groups const, prevent abuse 2013-11-19 16:39:06 -05:00
flow.c net: rename vlan_tx_* helpers since "tx" is misleading there 2015-01-13 17:51:08 -05:00
flow.h openvswitch: Add support for OVS_FLOW_ATTR_PROBE. 2014-11-09 18:58:44 -08:00
flow_netlink.c openvswitch: Fix MPLS action validation. 2014-12-23 23:57:31 -05:00
flow_netlink.h openvswitch: Add support for OVS_FLOW_ATTR_PROBE. 2014-11-09 18:58:44 -08:00
flow_table.c net: replace remaining users of arch_fast_hash with jhash 2014-12-10 15:17:45 -05:00
flow_table.h openvswitch: Constify various function arguments 2014-11-09 18:58:44 -08:00
Kconfig openvswitch: Fix build failure. 2014-11-14 01:24:27 -05:00
Makefile ovs: Turn vports with dependencies into separate modules 2014-10-28 14:43:18 -04:00
vport-geneve.c openvswitch: Introduce ovs_tunnel_route_lookup 2015-01-14 16:32:06 -05:00
vport-gre.c openvswitch: Introduce ovs_tunnel_route_lookup 2015-01-14 16:32:06 -05:00
vport-internal_dev.c openvswitch: Drop packets when interdev is not up 2014-11-05 23:52:35 -08:00
vport-internal_dev.h openvswitch: introduce rtnl ops stub 2014-07-01 14:40:17 -07:00
vport-netdev.c openvswitch: Constify various function arguments 2014-11-09 18:58:44 -08:00
vport-netdev.h ovs: Turn vports with dependencies into separate modules 2014-10-28 14:43:18 -04:00
vport-vxlan.c vxlan: Group Policy extension 2015-01-15 01:11:41 -05:00
vport.c openvswitch: Introduce ovs_tunnel_route_lookup 2015-01-14 16:32:06 -05:00
vport.h openvswitch: Introduce ovs_tunnel_route_lookup 2015-01-14 16:32:06 -05:00