Page MenuHomeVyOS Platform

Add VXLAN vnifilter support
Closed, ResolvedPublicFEATURE REQUEST


specifies whether the vxlan device is capable of vni filtering. Only works with a vxlan device with external flag set. once enabled, bridge vni command is used to manage the vni filtering table on the device. The device can only receive packets with vni's configured in the vni filtering table.

From Linux Kernel Patch

commit f9c4bb0b245cee35ef66f75bf409c9573d934cf9
Author: Roopa Prabhu <[email protected]>
Date:   Tue Mar 1 05:04:36 2022 +0000

    vxlan: vni filtering support on collect metadata device

    This patch adds vnifiltering support to collect metadata device.

    You can only use a single vxlan collect metadata device for a given
    vxlan udp port in the system today. The vxlan collect metadata device
    terminates all received vxlan packets. As shown in the below diagram,
    there are use-cases where you need to support multiple such vxlan devices in
    independent bridge domains. Each vxlan device must terminate the vni's
    it is configured for.
    Example usecase: In a service provider network a service provider
    typically supports multiple bridge domains with overlapping vlans.
    One bridge domain per customer. Vlans in each bridge domain are
    mapped to globally unique vxlan ranges assigned to each customer.

    vnifiltering support in collect metadata devices terminates only configured
    vnis. This is similar to vlan filtering in bridge driver. The vni filtering
    capability is provided by a new flag on collect metadata device.

    In the below pic:
            - customer1 is mapped to br1 bridge domain
            - customer2 is mapped to br2 bridge domain
            - customer1 vlan 10-11 is mapped to vni 1001-1002
            - customer2 vlan 10-11 is mapped to vni 2001-2002
            - br1 and br2 are vlan filtering bridges
            - vxlan1 and vxlan2 are collect metadata devices with
              vnifiltering enabled

    │  switch                                                          │
    │                                                                  │
    │         ┌───────────┐                 ┌───────────┐              │
    │         │           │                 │           │              │
    │         │   br1     │                 │   br2     │              │
    │         └┬─────────┬┘                 └──┬───────┬┘              │
    │     vlans│         │               vlans │       │               │
    │     10,11│         │                10,11│       │               │
    │          │     vlanvnimap:               │    vlanvnimap:        │
    │          │       10-1001,11-1002         │      10-2001,11-2002  │
    │          │         │                     │       │               │
    │   ┌──────┴┐     ┌──┴─────────┐       ┌───┴────┐  │               │
    │   │ swp1  │     │vxlan1      │       │ swp2   │ ┌┴─────────────┐ │
    │   │       │     │  vnifilter:│       │        │ │vxlan2        │ │
    │   └───┬───┘     │   1001,1002│       └───┬────┘ │ vnifilter:   │ │
    │       │         └────────────┘           │      │  2001,2002   │ │
    │       │                                  │      └──────────────┘ │
    │       │                                  │                       │
            │                                  │
            │                                  │
      ┌─────┴───────┐                          │
      │  customer1  │                    ┌─────┴──────┐
      │ host/VM     │                    │customer2   │
      └─────────────┘                    │ host/VM    │

    With this implementation, vxlan dst metadata device can
    be associated with range of vnis.
    struct vxlan_vni_node is introduced to represent
    a configured vni. We start with vni and its
    associated remote_ip in this structure. This
    structure can be extended to bring in other
    per vni attributes if there are usecases for it.
    A vni inherits an attribute from the base vxlan device
    if there is no per vni attributes defined.

    struct vxlan_dev gets a new rhashtable for
    vnis called vxlan_vni_group. vxlan_vnifilter.c
    implements the necessary netlink api, notifications
    and helper functions to process and manage lifecycle
    of vxlan_vni_node.

    This patch also adds new helper functions in vxlan_multicast.c
    to handle per vni remote_ip multicast groups which are part
    of vxlan_vni_group.

    Fix build problems:
    Reported-by: kernel test robot <[email protected]>
    Signed-off-by: Roopa Prabhu <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>


Difficulty level
Normal (likely a few hours)
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Improvement (missing useful functionality)

Related Objects

ResolvedFEATURE REQUESTjack9603301

Event Timeline

c-po changed the task status from Open to In progress.
c-po claimed this task.
c-po triaged this task as Normal priority.
c-po changed Difficulty level from Unknown (require assessment) to Normal (likely a few hours).
c-po changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
c-po changed Issue type from Unspecified (please specify) to Improvement (missing useful functionality).
c-po moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.
c-po moved this task from Need Triage to Finished on the VyOS 1.5 Circinus board.