Currently, ip6_tnl_xmit_ctl drops tunneled packets if the remote address (outer v6 destination) is one of host's locally configured addresses. Same applies to ip6_tnl_rcv_ctl: it drops packets if the remote address (outer v6 source) is a local address. This prevents using ipxip6 (and ip6_gre) tunnels whose local/remote endpoints are on same host; OTOH v4 tunnels (ipip or gre) allow such configurations. An example where this proves useful is a system where entities are identified by their unique v6 addresses, and use tunnels to encapsulate traffic between them. The limitation prevents placing several entities on same host. Introduce IP6_TNL_F_ALLOW_LOCAL_REMOTE which allows to bypass this restriction.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -20,6 +20,8 @@ · 19 unmodified lines | |||
| 20 | #define IP6_TNL_F_RCV_DSCP_COPY 0x10 | 20 | #define IP6_TNL_F_RCV_DSCP_COPY 0x10 |
| 21 | /* copy fwmark from inner packet */ | 21 | /* copy fwmark from inner packet */ |
| 22 | #define IP6_TNL_F_USE_ORIG_FWMARK 0x20 | 22 | #define IP6_TNL_F_USE_ORIG_FWMARK 0x20 |
| 23 | /* allow remote endpoint on the local node */ | ||
| 24 | #define IP6_TNL_F_ALLOW_LOCAL_REMOTE 0x40 | ||
| 23 | 25 | ||
| 24 | struct ip6_tnl_parm { | 26 | struct ip6_tnl_parm { |
| 25 | char name[IFNAMSIZ]; /* name of tunnel device */ | 27 | char name[IFNAMSIZ]; /* name of tunnel device */ |