peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-23 01:23:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1246 from kernelkit/gre-plus-plus

Browse Source 
Add TTL, ToS/DSCP, and PMTU Discovery configuration to tunnels
This commit is contained in:
Joachim Wiberg
2025-11-07 15:54:19 +01:00
committed by GitHub
parent bf2e739a0e 461d8b7e08
commit 0a31770071
27 changed files with 914 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/ChangeLog.md
+4
View File
@@ -20,6 +20,10 @@ All notable changes to the project are documented in this file.
the [`latest-boot` release][lastest-boot] tag
- The `utils/mkimage.sh` script now supports fetching the bootloader
- The raspberrypi-rpi64 board's bootloader is now aptly named rpi64
- Add support for configuring TTL, ToS/DSCP, and Path MTU Discovery on GRE and
VXLAN tunnels. This also changes the default TTL of tunnels to 64, from the
kernel default (*inherit*), which in turn fixes reported issues with dropped
OSPF Hello frames in GRE tunnels
### Fixes
doc/dhcp.md
+13 -14
View File
@@ -21,10 +21,9 @@ with an address pool:
```
admin@example:/> configure
admin@example:/config/> edit dhcp-server
admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
admin@example:/config/> edit dhcp-server subnet 192.168.2.0/24
admin@example:/config/dhcp-server/…/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
admin@example:/config/dhcp-server/…/192.168.2.0/24/> leave
```
When setting up the server from the CLI, the system automatically adds a
@@ -70,21 +69,21 @@ To reserve specific IP addresses for clients based on their MAC address,
hostname, or client ID:
```
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit host 192.168.2.10
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set match mac-address 00:11:22:33:44:55
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set hostname printer
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> leave
admin@example:/config/dhcp-server/…/192.168.2.0/24/> edit host 192.168.2.10
admin@example:/config/dhcp-server/…/192.168.2.10/> set match mac-address 00:11:22:33:44:55
admin@example:/config/dhcp-server/…/192.168.2.10/> set hostname printer
admin@example:/config/dhcp-server/…/192.168.2.10/> leave
```
Match hosts using a client identifier instead of MAC address:
```
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit host 192.168.1.50
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> edit match
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> set client-id hex c0:ff:ee
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> leave
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> set lease-time infinite
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> leave
admin@example:/config/dhcp-server/…/192.168.1.0/24/> edit host 192.168.1.50
admin@example:/config/dhcp-server/…/192.168.1.50/> edit match
admin@example:/config/dhcp-server/…/match/> set client-id hex c0:ff:ee
admin@example:/config/dhcp-server/…/match/> leave
admin@example:/config/dhcp-server/…/192.168.1.50/> set lease-time infinite
admin@example:/config/dhcp-server/…/192.168.1.50/> leave
```
The `hex` prefix here ensures matching of client ID is done using the
doc/firewall.md
+36 -36
View File
@@ -289,25 +289,25 @@ blocks external threats.
admin@example:/config/> <b>edit firewall</b>
admin@example:/config/firewall/> <b>set default wan</b>
admin@example:/config/firewall/> <b>edit zone lan</b>
admin@example:/config/firewall/zone/lan/> <b>set description "Internal LAN network - trusted"</b>
admin@example:/config/firewall/zone/lan/> <b>set action accept</b>
admin@example:/config/firewall/zone/lan/> <b>set interface eth1</b>
admin@example:/config/firewall/zone/lan/> <b>set service ssh</b>
admin@example:/config/firewall/zone/lan/> <b>set service dhcp</b>
admin@example:/config/firewall/zone/lan/> <b>set service dns</b>
admin@example:/config/firewall/zone/lan/> <b>end</b>
admin@example:/config/firewall/…/lan/> <b>set description "Internal LAN network - trusted"</b>
admin@example:/config/firewall/…/lan/> <b>set action accept</b>
admin@example:/config/firewall/…/lan/> <b>set interface eth1</b>
admin@example:/config/firewall/…/lan/> <b>set service ssh</b>
admin@example:/config/firewall/…/lan/> <b>set service dhcp</b>
admin@example:/config/firewall/…/lan/> <b>set service dns</b>
admin@example:/config/firewall/…/lan/> <b>end</b>
admin@example:/config/firewall/> <b>edit zone wan</b>
admin@example:/config/firewall/zone/wan/> <b>set description "External WAN interface - untrusted"</b>
admin@example:/config/firewall/zone/wan/> <b>set action drop</b>
admin@example:/config/firewall/zone/wan/> <b>set interface eth0</b>
admin@example:/config/firewall/zone/wan/> <b>end</b>
admin@example:/config/firewall/…/wan/> <b>set description "External WAN interface - untrusted"</b>
admin@example:/config/firewall/…/wan/> <b>set action drop</b>
admin@example:/config/firewall/…/wan/> <b>set interface eth0</b>
admin@example:/config/firewall/…/wan/> <b>end</b>
admin@example:/config/firewall/> <b>edit policy loc-to-wan</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set description "Allow LAN traffic to WAN with SNAT"</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set ingress lan</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set egress wan</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set action accept</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set masquerade</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>leave</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set description "Allow LAN traffic to WAN with SNAT"</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set ingress lan</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set egress wan</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set action accept</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set masquerade</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>leave</b>
</pre></code>
### Enterprise Gateway
@@ -317,28 +317,28 @@ resources. We can build upon the Home/Office Router example above and add
a DMZ zone with additional policies for controlled access.
<code><pre>admin@example:/> <b>configure</b>
admin@example:/config/> <b>edit firewall zone dmz</b>
admin@example:/config/firewall/zone/dmz/> <b>set description "Semi-trusted public services"</b>
admin@example:/config/firewall/zone/dmz/> <b>set action drop</b>
admin@example:/config/firewall/zone/dmz/> <b>set interface eth1</b>
admin@example:/config/firewall/zone/dmz/> <b>set service ssh</b>
admin@example:/config/firewall/zone/dmz/> <b>end</b>
admin@example:/config/firewall/…/dmz/> <b>set description "Semi-trusted public services"</b>
admin@example:/config/firewall/…/dmz/> <b>set action drop</b>
admin@example:/config/firewall/…/dmz/> <b>set interface eth1</b>
admin@example:/config/firewall/…/dmz/> <b>set service ssh</b>
admin@example:/config/firewall/…/dmz/> <b>end</b>
admin@example:/config/firewall/> <b>edit policy loc-to-wan</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set description "Allow local networks (LAN+DMZ) to WAN with SNAT"</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set ingress dmz</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set egress wan</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set action accept</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>set masquerade</b>
admin@example:/config/firewall/policy/loc-to-wan/> <b>end</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set description "Allow local networks (LAN+DMZ) to WAN with SNAT"</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set ingress dmz</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set egress wan</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set action accept</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>set masquerade</b>
admin@example:/config/firewall/…/loc-to-wan/> <b>end</b>
admin@example:/config/firewall/> <b>edit policy lan-to-dmz</b>
admin@example:/config/firewall/policy/lan-to-dmz/> <b>set description "Allow LAN to manage DMZ services"</b>
admin@example:/config/firewall/policy/lan-to-dmz/> <b>set ingress lan</b>
admin@example:/config/firewall/policy/lan-to-dmz/> <b>set egress dmz</b>
admin@example:/config/firewall/policy/lan-to-dmz/> <b>set action accept</b>
admin@example:/config/firewall/policy/lan-to-dmz/> <b>end</b>
admin@example:/config/firewall/…/lan-to-dmz/> <b>set description "Allow LAN to manage DMZ services"</b>
admin@example:/config/firewall/…/lan-to-dmz/> <b>set ingress lan</b>
admin@example:/config/firewall/…/lan-to-dmz/> <b>set egress dmz</b>
admin@example:/config/firewall/…/lan-to-dmz/> <b>set action accept</b>
admin@example:/config/firewall/…/lan-to-dmz/> <b>end</b>
admin@example:/config/firewall/> <b>edit zone wan port-forward 8080 tcp</b>
admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>set to addr 192.168.2.10</b>
admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>set to port 80</b>
admin@example:/config/firewall/zone/wan/port-forward/8080/tcp/> <b>leave</b>
admin@example:/config/firewall/…/tcp/> <b>set to addr 192.168.2.10</b>
admin@example:/config/firewall/…/tcp/> <b>set to port 80</b>
admin@example:/config/firewall/…/tcp/> <b>leave</b>
</pre></code>
This adds a DMZ zone for public services, updates the internet access policy
doc/networking.md
+27 -27
View File
@@ -1264,18 +1264,18 @@ control plane protocol. For our examples we use the instance name
For a route with destination 192.168.200.0/24 via 192.168.1.1:
admin@example:/> configure
admin@example:/config/> edit routing control-plane-protocol static name default
admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv4 route 192.168.200.0/24 next-hop next-hop-address 192.168.1.1
admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol static name default ipv4
admin@example:/config/routing/…/ipv4/> set route 192.168.200.0/24 next-hop next-hop-address 192.168.1.1
admin@example:/config/routing/…/ipv4/> leave
admin@example:/>
For a "floating" static route with destination 10.0.0.0/16 via a backup
router 192.168.1.1, using the highest possible distance:
admin@example:/> configure
admin@example:/config/> edit routing control-plane-protocol static name default
admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv4 route 10.0.0.0/16 next-hop next-hop-address 192.168.1.1 route-preference 254
admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol static name default ipv4
admin@example:/config/routing/…/ipv4/> set route 10.0.0.0/16 next-hop next-hop-address 192.168.1.1 route-preference 254
admin@example:/config/routing/…/ipv4/> leave
admin@example:/>
> [!TIP]
@@ -1286,9 +1286,9 @@ router 192.168.1.1, using the highest possible distance:
### IPv6 Static routes
admin@example:/> configure
admin@example:/config/> edit routing control-plane-protocol static name default
admin@example:/config/routing/control-plane-protocol/static/name/default/> set ipv6 route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1
admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol static name default ipv6
admin@example:/config/routing/…/ipv6/> set route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1
admin@example:/config/routing/…/ipv6/> leave
admin@example:/>
@@ -1297,9 +1297,9 @@ router 192.168.1.1, using the highest possible distance:
The system supports OSPF dynamic routing for IPv4, i.e., OSPFv2. To
enable OSPF and set one active interface in area 0:
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@example:/config/routing/…/ospf/> set area 0.0.0.0 interface e0 enabled
admin@example:/config/routing/…/ospf/> leave
admin@example:/>
> [!TIP]
@@ -1312,10 +1312,10 @@ enable OSPF and set one active interface in area 0:
In addition to *regular* OSPF areas, area types *NSSA* and *Stub* are
also supported. To configure an NSSA area with summary routes:
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 area-type nssa-area
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> set ospf area 0.0.0.1 summary true
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@example:/config/routing/…/ospf/> set area 0.0.0.1 area-type nssa-area
admin@example:/config/routing/…/ospf/> set area 0.0.0.1 summary true
admin@example:/config/routing/…/ospf/> leave
admin@example:/>
@@ -1324,9 +1324,9 @@ also supported. To configure an NSSA area with summary routes:
It is possible to enable BFD per OSPF interface to speed up detection of
link loss.
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set area 0.0.0.0 interface e0 bfd enabled true
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@example:/config/routing/…/ospf/> set area 0.0.0.0 interface e0 bfd enabled true
admin@example:/config/routing/…/ospf/> leave
admin@example:/>
@@ -1337,9 +1337,9 @@ and BFD for OSPF per interface (*bfd enabled true*). These and other
OSPF interface settings are done in context of an OSFP area, e.g., *area
0.0.0.0*. Available commands can be listed using the `?` mark.
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> edit ospf area 0.0.0.0
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/> edit interface e0
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set ?
admin@example:/config/routing/…/> edit ospf area 0.0.0.0
admin@example:/config/routing/…/ospf/area/0.0.0.0/> edit interface e0
admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set ?
bfd BFD interface configuration.
cost Interface's cost.
dead-interval Interval after which a neighbor is declared down
@@ -1349,13 +1349,13 @@ OSPF interface settings are done in context of an OSFP area, e.g., *area
passive Enables/disables a passive interface. A passive
retransmit-interval Interval between retransmitting unacknowledged Link
transmit-delay Estimated time needed to transmit Link State Update
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set
admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set
For example, setting the OSPF *interface type* to *point-to-point* for
an Ethernet interface can be done as follows.
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>
admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
admin@example:/config/routing/…/ospf/area/0.0.0.0/interface/e0/>
#### OSPF global settings
@@ -1364,12 +1364,12 @@ global settings for route redistribution and OSPF router identifier.
```
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set ?
admin@example:/config/routing/…/ospf/> set ?
area List of OSPF areas.
default-route-advertise Distribute default route to network
explicit-router-id Defined in RFC 2328. A 32-bit number
redistribute Redistribute protocols into OSPF
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set
admin@example:/config/routing/…/ospf/> set
```
- Explicit router ID: By default the router will pick an IP address
doc/syslog.md
+15 -16
View File
@@ -23,17 +23,16 @@ For a list of available log facilities, see the table in a later section.
```
admin@example:/> configure
admin@example:/config/> edit syslog
admin@example:/config/syslog/> edit actions log-file file:/media/log/mylog
admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list
admin@example:/config/> edit syslog actions log-file file:/media/log/mylog
admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list
all audit auth authpriv console cron cron2 daemon ftp kern
local0 local1 local2 local3 local4 local5 local6 local7 lpr mail
news ntp syslog user uucp
admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity
admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list all severity
alert all critical debug emergency error info none notice warning
admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list all severity critical
admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> set facility-list mail severity warning
admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> leave
admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list all severity critical
admin@example:/config/syslog/…/file:/media/log/mylog/> set facility-list mail severity warning
admin@example:/config/syslog/…/file:/media/log/mylog/> leave
admin@example:/>
```
@@ -137,11 +136,11 @@ perform time stamping at the time of arrival.
Configuring the log format is the same for log files and remotes:
```
admin@example:/config/> edit syslog actions log-file file:foobar
admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format
admin@example:/config/> edit syslog actions log-file file:foobar
admin@example:/config/syslog/…/file:foobar/> set log-format
bsd rfc3164 rfc5424
admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format rfc5424
admin@example:/config/syslog/actions/log-file/file:foobar/> leave
admin@example:/config/syslog/…/file:foobar/> set log-format rfc5424
admin@example:/config/syslog/…/file:foobar/> leave
admin@example:/>
```
@@ -163,13 +162,13 @@ up, as well as local policy.
admin@example:/config/> edit syslog
actions file-rotation server
admin@example:/config/> edit syslog actions destination moon
admin@example:/config/syslog/actions/destination/moon/> set
admin@example:/config/syslog/…/moon/> set
facility-list log-format udp
admin@example:/config/syslog/actions/destination/moon/> set udp
admin@example:/config/syslog/…/moon/> set udp
address port
admin@example:/config/syslog/actions/destination/moon/> set udp address 192.168.0.12
admin@example:/config/syslog/actions/destination/moon/> set facility-list container severity all
admin@example:/config/syslog/actions/destination/moon/> leave
admin@example:/config/syslog/…/moon/> set udp address 192.168.0.12
admin@example:/config/syslog/…/moon/> set facility-list container severity all
admin@example:/config/syslog/…/moon/> leave
admin@example:/>
```
doc/tunnels.md
+194 -10
View File
@@ -1,28 +1,212 @@
# Tunnel configuration
# Tunnel Configuration
Tunnel traffic from point A to point B
Infix supports multiple tunnel encapsulation protocols for connecting
remote networks or devices across an IP backbone. Tunnels encapsulate
packets within IP datagrams, allowing traffic to traverse intermediate
networks transparently.
> [!IMPORTANT]
> When issuing `leave` to activate your changes, remember to also save
> your settings, `copy running-config startup-config`. See the [CLI
> Introduction](cli/introduction.md) for a background.
## Generic Routing Encapsulation (GRE)
The support for GRE tunnels includes IPv4 and IPv6 tunnels both in GRE
(IP) and GRETAP (MAC) modes.
GRE tunnels provide a simple and efficient method to encapsulate various
network layer protocols over IP networks. Infix supports both IPv4 and
IPv6 tunnels in two modes:
- **GRE (Layer 3):** Point-to-point IP tunnel for routing protocols and
routed traffic
- **GRETAP (Layer 2):** Ethernet tunnel for bridging Layer 2 networks
> [!TIP]
> If you name your tunnel interface `greN` or `gretapN`, where `N` is a
> number, the CLI infers the interface type automatically.
### Basic GRE Configuration
A basic GRE tunnel for routing between two sites:
```
admin@example:/config/> edit interface gre1
admin@example:/config/interface/gre1/> set type gretap
admin@example:/config/interface/gre1/> set gre local 192.168.3.1 remote 192.168.3.2
admin@example:/config/interface/gre1/> leave
admin@example:/> configure
admin@example:/config/> edit interface gre0
admin@example:/config/interface/gre0/> set gre local 192.168.3.1 remote 192.168.3.2
admin@example:/config/interface/gre0/> set ipv4 address 10.255.0.1 prefix-length 30
admin@example:/config/interface/gre0/> leave
admin@example:/>
```
## Virtual eXtensible Local Area Network (VXLAN)
This creates a Layer 3 tunnel between 192.168.3.1 and 192.168.3.2 using
the outer IP addresses, with the tunnel itself using 10.255.0.0/30 for
the inner IP addressing.
The support for VXLAN tunnels includes IPv4 and IPv6.
### GRETAP Configuration
GRETAP tunnels operate at Layer 2, allowing bridging across the tunnel:
```
admin@example:/> configure
admin@example:/config/> edit interface gretap0
admin@example:/config/interface/gretap0/> set type gretap
admin@example:/config/interface/gretap0/> set gre local 192.168.3.1 remote 192.168.3.2
admin@example:/config/interface/gretap0/> leave
admin@example:/>
```
GRETAP interfaces can be added to a bridge, bridging local and remote Ethernet
segments. See the [Bridge Configuration](networking.md#bridge-configuration)
for more on bridges.
### OSPF over GRE
GRE tunnels are commonly used to carry dynamic routing protocols like
OSPF across networks that don't support multicast or where you want to
create a virtual topology different from the physical network.
Example topology: Two sites connected via a GRE tunnel, running OSPF to
exchange routes.
**Site A configuration:**
```
admin@siteA:/> configure
admin@siteA:/config/> edit interface gre0
admin@siteA:/config/interface/gre0/> set gre local 203.0.113.1 remote 203.0.113.2
admin@siteA:/config/interface/gre0/> set ipv4 address 10.255.0.1 prefix-length 30
admin@siteA:/config/interface/gre0/> set ipv4 forwarding
admin@siteA:/config/interface/gre0/> end
admin@siteA:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@siteA:/config/routing/…/ospf/> set area 0.0.0.0 interface gre0
admin@siteA:/config/routing/…/ospf/> leave
admin@siteA:/>
```
**Site B configuration:**
```
admin@siteB:/> configure
admin@siteB:/config/> edit interface gre0
admin@siteB:/config/interface/gre0/> set gre local 203.0.113.2 remote 203.0.113.1
admin@siteB:/config/interface/gre0/> set ipv4 address 10.255.0.2 prefix-length 30
admin@siteB:/config/interface/gre0/> set ipv4 forwarding
admin@siteB:/config/interface/gre0/> end
admin@siteB:/config/> edit routing control-plane-protocol ospfv2 name default ospf
admin@siteB:/config/routing/…/ospf/> set area 0.0.0.0 interface gre0
admin@siteB:/config/routing/…/ospf/> leave
admin@siteB:/>
```
Once configured, OSPF will establish a neighbor relationship through the
tunnel and exchange routes between the sites. For more on OSPF
configuration, see [Routing Configuration](routing.md).
> [!NOTE]
> Consider adjusting MTU on the tunnel interface to account for GRE
> overhead (typically 24 bytes for IPv4, 44 bytes for IPv6) to avoid
> fragmentation issues.
### Advanced Tunnel Settings
All tunnel types support common parameters for controlling tunnel behavior
and performance.
#### Time To Live (TTL)
The TTL setting controls the Time To Live value for the outer tunnel packets.
By default, tunnels use a fixed TTL of 64, which allows packets to traverse
multiple hops between tunnel endpoints.
```
admin@example:/config/> edit interface gre0
admin@example:/config/interface/gre0/> set gre ttl 255
admin@example:/config/interface/gre0/> leave
```
Valid values are 1-255, or the special value `inherit` which copies the TTL
from the encapsulated packet.
> [!IMPORTANT]
> The `inherit` mode can cause problems with routing protocols like OSPF
> that use TTL=1 for their packets. For tunnels carrying routing protocols,
> always use a fixed TTL value (typically 64 or 255).
#### Type of Service (ToS)
The ToS setting controls QoS marking for tunnel traffic:
```
admin@example:/config/> edit interface gre0
admin@example:/config/interface/gre0/> set gre tos 0x10
admin@example:/config/interface/gre0/> leave
```
Valid values are 0-255 for fixed ToS/DSCP marking, or `inherit` (default)
to copy the ToS value from the encapsulated packet.
#### Path MTU Discovery (GRE only)
The `pmtu-discovery` setting can be used to control the Path MTU Discovery on
GRE tunnels. When enabled (default), the tunnel respects the Don't Fragment
(DF) bit and performs PMTU discovery:
```
admin@example:/config/> edit interface gre0
admin@example:/config/interface/gre0/> set gre pmtudisc false
admin@example:/config/interface/gre0/> leave
```
Disabling PMTU discovery may be necessary in networks with broken ICMP
filtering but can lead to suboptimal performance and fragmentation.
## Virtual eXtensible Local Area Network (VXLAN)
VXLAN is a network virtualization technology that encapsulates Layer 2
Ethernet frames within Layer 4 UDP datagrams. It uses a 24-bit segment
ID, termed VXLAN Network Identifier (VNI), allowing up to 16 million
isolated networks.
Infix supports both IPv4 and IPv6 for VXLAN tunnel endpoints.
### Basic VXLAN Configuration
> [!TIP]
> If you name your VXLAN interface `vxlanN`, where `N` is a number, the
> CLI infers the interface type automatically.
```
admin@example:/> configure
admin@example:/config/> edit interface vxlan100
admin@example:/config/interface/vxlan100/> set vxlan local 192.168.3.1
admin@example:/config/interface/vxlan100/> set vxlan remote 192.168.3.2
admin@example:/config/interface/vxlan100/> set vxlan vni 100
admin@example:/config/interface/vxlan100/> leave
admin@example:/>
```
The VNI uniquely identifies the VXLAN segment and must match on both
tunnel endpoints.
### VXLAN with Custom UDP Port
The default VXLAN UDP destination port is 4789 (IANA assigned). In some
cases you may need to use a different port:
```
admin@example:/> configure
admin@example:/config/> edit interface vxlan100
admin@example:/config/interface/vxlan100/> set vxlan local 192.168.3.1
admin@example:/config/interface/vxlan100/> set vxlan remote 192.168.3.2
admin@example:/config/interface/vxlan100/> set vxlan vni 100
admin@example:/config/interface/vxlan100/> set vxlan remote-port 8472
admin@example:/config/interface/vxlan100/> leave
admin@example:/>
```
The remote-port setting allows interoperability with systems using
non-standard VXLAN ports.
> [!NOTE]
> VXLAN tunnels also support the `ttl` and `tos` settings described in
> the [Advanced Tunnel Settings](#advanced-tunnel-settings) section above.
doc/wifi.md
+3 -3
View File
@@ -83,9 +83,9 @@ and 63 characters
```
admin@example:/> configure
admin@example:/config/> edit keystore symmetric-key example
admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
admin@example:/config/keystore/symmetric-key/example/> leave
admin@example:/config/keystore/…/example/> set key-format wifi-preshared-key-format
admin@example:/config/keystore/…/example/> set cleartext-key mysecret
admin@example:/config/keystore/…/example/> leave
admin@example:/>
```
src/confd/src/infix-if-gre.c
+22 -4
View File
@@ -5,7 +5,8 @@
int gre_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
{
const char *local, *remote;
const char *local, *remote, *ttl, *tos, *pmtudisc;
const char *ifname = lydx_get_cattr(cif, "name");
struct lyd_node *gre;
int ipv6;
@@ -15,8 +16,7 @@ int gre_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
ipv6 = !!strstr(local, ":");
fprintf(ip, "link add name %s",
lydx_get_cattr(cif, "name"));
fprintf(ip, "link add name %s", ifname);
switch (iftype_from_iface(cif)) {
case IFT_GRE:
@@ -30,6 +30,24 @@ int gre_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
return -EINVAL;
}
fprintf(ip, " local %s remote %s\n", local, remote);
fprintf(ip, " local %s remote %s", local, remote);
ttl = lydx_get_cattr(gre, "ttl");
if (ttl)
fprintf(ip, " ttl %s", ttl);
tos = lydx_get_cattr(gre, "tos");
if (tos)
fprintf(ip, " tos %s", tos);
pmtudisc = lydx_get_cattr(gre, "pmtu-discovery");
if (pmtudisc && !strcmp(pmtudisc, "false"))
fprintf(ip, " nopmtudisc");
fputc('\n', ip);
/* GRE interfaces don't have IFF_MULTICAST by default */
fprintf(ip, "link set dev %s multicast on\n", ifname);
return 0;
}
src/confd/src/infix-if-vxlan.c
+9
View File
@@ -6,6 +6,7 @@
int vxlan_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
{
struct lyd_node *vxlan = NULL;
const char *ttl, *tos;
vxlan = lydx_get_descendant(lyd_child(cif), "vxlan", NULL);
if (!vxlan)
@@ -18,6 +19,14 @@ int vxlan_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip)
lydx_get_cattr(vxlan, "remote"),
lydx_get_cattr(vxlan, "remote-port"));
ttl = lydx_get_cattr(vxlan, "ttl");
if (ttl)
fprintf(ip, " ttl %s", ttl);
tos = lydx_get_cattr(vxlan, "tos");
if (tos)
fprintf(ip, " tos %s", tos);
link_gen_address(cif, ip);
fputc('\n', ip);
src/confd/yang/confd.inc
+1 -1
View File
@@ -37,7 +37,7 @@ MODULES=(
"ieee802-ethernet-interface@2019-06-21.yang"
"infix-ethernet-interface@2024-02-27.yang"
"infix-factory-default@2023-06-28.yang"
"infix-interfaces@2025-06-17.yang -e vlan-filtering"
"infix-interfaces@2025-11-06.yang -e vlan-filtering"
"ietf-crypto-types -e cleartext-symmetric-keys"
"infix-crypto-types@2025-06-17.yang"
"ietf-keystore -e symmetric-keys"
src/confd/yang/confd/infix-if-gre.yang
+21 -1
View File
@@ -16,6 +16,12 @@ submodule infix-if-gre {
contact "kernelkit@googlegroups.com";
description "GRE and GRETAP tunnel extension for ietf-interfaces";
revision 2025-11-06 {
description "Use tunnel-common grouping for local, remote, TTL, and TOS/DSCP.
Add GRE-specific pmtu-discovery setting.";
reference "internal";
}
revision 2024-12-20 {
description "Initial revision.";
reference "internal";
@@ -29,7 +35,21 @@ submodule infix-if-gre {
description "Augments the interface model with GRE tunnels.";
container gre {
uses local-remote;
uses tunnel-common;
leaf pmtu-discovery {
type boolean;
default true;
description
"Enable or disable Path MTU Discovery on the tunnel.
When enabled (default), the tunnel respects the Don't Fragment (DF)
bit and performs PMTU discovery. When disabled, the tunnel will
fragment packets as needed.
Disabling PMTU discovery may be necessary in networks with broken
ICMP filtering but can lead to suboptimal performance.";
}
}
}
}
src/confd/yang/confd/infix-if-gre@2024-12-20.yang → src/confd/yang/confd/infix-if-gre@2025-11-06.yang
View File
src/confd/yang/confd/infix-if-vxlan.yang
+9 -3
View File
@@ -20,6 +20,11 @@ submodule infix-if-vxlan {
contact "kernelkit@googlegroups.com";
description "VXLAN tunnel extension for ietf-interfaces";
revision 2025-11-06 {
description "Use new tunnel-common grouping for local, remote, ttl, and tos.";
reference "internal";
}
revision 2025-01-13 {
description "Initial revision.";
reference "internal";
@@ -36,18 +41,19 @@ submodule infix-if-vxlan {
}
description "Augments the interface model with VXLAN tunnels.";
container vxlan {
uses local-remote;
uses tunnel-common;
leaf remote-port {
type inet-types:port-number;
default 4789;
description
"VXLAN destination UDP port. Valid range: 0..65535. Default is 4789 (IANA-assigned VXLAN UDP port).";
"VXLAN destination UDP port, valid range: 0..65535.";
}
leaf vni {
type vni;
mandatory true;
description
"VXLAN Network Identifier (VNI), valid values are 0 to 16777215.";
"VXLAN Network Identifier (VNI), valid range: 0..16777215.";
}
}
}
src/confd/yang/confd/infix-if-vxlan@2025-01-13.yang → src/confd/yang/confd/infix-if-vxlan@2025-11-06.yang
View File
src/confd/yang/confd/infix-interfaces.yang
+52 -3
View File
@@ -33,6 +33,11 @@ module infix-interfaces {
contact "kernelkit@googlegroups.com";
description "Linux bridge and lag extensions for ietf-interfaces.";
revision 2025-11-06 {
description "Use new tunnel-common grouping for local, remote, ttl, and tos.";
reference "internal";
}
revision 2025-06-17 {
description "Add support for Wi-Fi client.";
reference "internal";
@@ -106,14 +111,16 @@ module infix-interfaces {
reference "internal";
}
grouping local-remote {
description "Local address to use as source address";
grouping tunnel-common {
description "Common tunnel parameters applicable to all tunnel types.";
leaf local {
type inet:ip-address;
mandatory true;
description "Local address to use as source address for the tunnel.";
}
leaf remote {
description "Peer address";
type inet:ip-address;
must "(contains(../local, ':') and contains(., ':'))
or (not(contains(../local, ':')) and not(contains(., ':')))" {
@@ -121,6 +128,48 @@ module infix-interfaces {
"Local and remote must be both IPv4 or both IPv6 addresses.";
}
mandatory true;
description "Remote peer address for the tunnel.";
}
leaf ttl {
type union {
type uint8 {
range "1..255";
}
type enumeration {
enum inherit {
description
"Copy TTL from inner packet (default kernel behavior).
WARNING: This can cause issues with protocols like OSPF
that use TTL=1 for their packets.";
}
}
}
default 64;
description
"Time To Live (TTL) for IPv4 or Hop Limit for IPv6 tunnel packets.
A fixed value (1-255) sets the outer packet TTL regardless of inner
packet TTL. The 'inherit' mode copies TTL from the encapsulated packet.
For OSPF and other routing protocols over tunnels, a fixed value
(typically 64 or 255) should be used to ensure packets can traverse
multiple hops between tunnel endpoints.";
}
leaf tos {
type union {
type uint8;
type enumeration {
enum inherit {
description "Copy ToS/DSCP from inner packet.";
}
}
}
default "inherit";
description
"Type of Service (IPv4) or Traffic Class (IPv6) for tunnel packets.
Can be a fixed value (0-255) for QoS marking, or 'inherit' to copy
from the encapsulated packet.";
}
}
src/confd/yang/confd/infix-interfaces@2025-06-17.yang → src/confd/yang/confd/infix-interfaces@2025-11-06.yang
View File
test/case/ietf_interfaces/tunnel_ttl/Readme.adoc
+6
View File
@@ -0,0 +1,6 @@
include::gre.adoc[]
<<<
include::vxlan.adoc[]
test/case/ietf_interfaces/tunnel_ttl/gre.adoc
+32
View File
@@ -0,0 +1,32 @@
=== GRE Tunnel TTL verification
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/ietf_interfaces/tunnel_ttl]
==== Description
Verify that GRE and VXLAN tunnels use a fixed TTL (default 64) for
encapsulated frames instead of inheriting the TTL from inner packets.
Critical for protocols like OSPF that use TTL=1 for their packets.
The test setup creates a tunnel between R1 and R3 so that injecting
a frame with TTL=3 from PC:west, routing it through the tunnel, it
would still reach PC:east. (Had it been routed via R2 it would be too
many hops and the TTL would reach zero before the last routing step.)
PC:west -- R1 -- R2 -- R3 -- PC:east
`== Tunnel =='
==== Topology
image::topology.svg[GRE Tunnel TTL verification topology, align=center, scaledwidth=75%]
==== Sequence
. Set up topology and attach to target DUTs
. Configure R1 with gre tunnel to R3
. Configure R2 as intermediate router (underlay forwarding)
. Configure R3 with gre tunnel to R1
. Send ping from PC:west to PC:east with low TTL
. Verify packets arrived at PC:east
test/case/ietf_interfaces/tunnel_ttl/gre.py
Symlink
+1
View File
@@ -0,0 +1 @@
test.py
test/case/ietf_interfaces/tunnel_ttl/test.py
Executable
+269
View File
@@ -0,0 +1,269 @@
#!/usr/bin/env python3
"""Tunnel TTL Verification
Verify that GRE and VXLAN tunnels use a fixed TTL (default 64) for
encapsulated frames instead of inheriting the TTL from inner packets.
Critical for protocols like OSPF that use TTL=1 for their packets.
The test setup creates a tunnel between R1 and R3 so that injecting
a frame with TTL=3 from PC:west, routing it through the tunnel, it
would still reach PC:east. (Had it been routed via R2 it would be too
many hops and the TTL would reach zero before the last routing step.)
PC:west -- R1 -- R2 -- R3 -- PC:east
`== Tunnel =='
"""
import infamy
class ArgumentParser(infamy.ArgumentParser):
def __init__(self):
super().__init__()
self.add_argument("--tunnel")
# IP address plan
# PC:west subnet
PC_WEST_R1 = "192.168.10.1"
PC_WEST_HOST = "192.168.10.2"
PC_WEST_NET = "192.168.10.0/24"
# R1-R2 underlay subnet
R1_R2_R1 = "192.168.50.1"
R1_R2_R2 = "192.168.50.2"
R1_R2_NET = "192.168.50.0/24"
# R2-R3 underlay subnet
R2_R3_R2 = "192.168.60.1"
R2_R3_R3 = "192.168.60.2"
R2_R3_NET = "192.168.60.0/24"
# PC:east subnet
PC_EAST_R3 = "192.168.70.1"
PC_EAST_HOST = "192.168.70.2"
PC_EAST_NET = "192.168.70.0/24"
# Tunnel subnet
TUNNEL_R1 = "10.255.0.1"
TUNNEL_R3 = "10.255.0.2"
TUNNEL_NET = "10.255.0.0/30"
# Prefix lengths
PREFIX_24 = 24
PREFIX_30 = 30
# Test TTL value
TEST_TTL = 3
# VXLAN VNI
VNI = 10
with infamy.Test() as test:
with test.step("Set up topology and attach to target DUTs"):
arg = ArgumentParser()
env = infamy.Env(args=arg)
tunnel = env.args.tunnel
r1 = env.attach("R1", "mgmt")
r2 = env.attach("R2", "mgmt")
r3 = env.attach("R3", "mgmt")
with test.step(f"Configure R1 with {tunnel} tunnel to R3"):
# R1: Entry point, west facing PC, east facing R2, tunnel to R3
# Build tunnel container configs
container_r1 = {
"local": R1_R2_R1,
"remote": R2_R3_R3
}
container_r3 = {
"local": R2_R3_R3,
"remote": R1_R2_R1
}
CONTAINER_TYPE = tunnel
if tunnel == "vxlan":
container_r1["vni"] = VNI
container_r3["vni"] = VNI
r1.put_config_dicts({"ietf-interfaces": {
"interfaces": {
"interface": [{
"name": r1["west"],
"ipv4": {
"address": [{
"ip": PC_WEST_R1,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}, {
"name": r1["east"],
"ipv4": {
"address": [{
"ip": R1_R2_R1,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}, {
"name": f"{tunnel}0",
"type": f"infix-if-type:{tunnel}",
"ipv4": {
"address": [{
"ip": TUNNEL_R1,
"prefix-length": PREFIX_30
}],
"forwarding": True
},
CONTAINER_TYPE: container_r1
}]
}
}, "ietf-routing": {
"routing": {
"control-plane-protocols": {
"control-plane-protocol": [{
"type": "infix-routing:static",
"name": "default",
"static-routes": {
"ipv4": {
"route": [{
"destination-prefix": R2_R3_NET,
"next-hop": {
"next-hop-address": R1_R2_R2
}
}, {
"destination-prefix": PC_EAST_NET,
"next-hop": {
"next-hop-address": TUNNEL_R3
}
}]
}
}
}]
}
}
}})
with test.step("Configure R2 as intermediate router (underlay forwarding)"):
# R2: Intermediate router, just forwards packets between west and east
r2.put_config_dicts({"ietf-interfaces": {
"interfaces": {
"interface": [{
"name": r2["west"],
"ipv4": {
"address": [{
"ip": R1_R2_R2,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}, {
"name": r2["east"],
"ipv4": {
"address": [{
"ip": R2_R3_R2,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}]
}
}})
with test.step(f"Configure R3 with {tunnel} tunnel to R1"):
# R3: Exit point, west facing R2, east facing PC, tunnel to R1
r3.put_config_dicts({"ietf-interfaces": {
"interfaces": {
"interface": [{
"name": r3["west"],
"ipv4": {
"address": [{
"ip": R2_R3_R3,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}, {
"name": r3["east"],
"ipv4": {
"address": [{
"ip": PC_EAST_R3,
"prefix-length": PREFIX_24
}],
"forwarding": True
}
}, {
"name": f"{tunnel}0",
"type": f"infix-if-type:{tunnel}",
"ipv4": {
"address": [{
"ip": TUNNEL_R3,
"prefix-length": PREFIX_30
}],
"forwarding": True
},
CONTAINER_TYPE: container_r3
}]
}
}, "ietf-routing": {
"routing": {
"control-plane-protocols": {
"control-plane-protocol": [{
"type": "infix-routing:static",
"name": "default",
"static-routes": {
"ipv4": {
"route": [{
"destination-prefix": R1_R2_NET,
"next-hop": {
"next-hop-address": R2_R3_R2
}
}, {
"destination-prefix": PC_WEST_NET,
"next-hop": {
"next-hop-address": TUNNEL_R1
}
}]
}
}
}]
}
}
}})
with test.step("Send ping from PC:west to PC:east with low TTL"):
_, pc_east = env.ltop.xlate("PC", "east")
with infamy.IsolatedMacVlan(pc_east) as east_ns:
east_ns.addip(PC_EAST_HOST)
east_ns.addroute("default", PC_EAST_R3)
pcap = east_ns.pcap("icmp")
with pcap:
_, pc_west = env.ltop.xlate("PC", "west")
with infamy.IsolatedMacVlan(pc_west) as west_ns:
west_ns.addip(PC_WEST_HOST)
west_ns.addroute("default", PC_WEST_R1)
# Send 3 pings with TTL=3, TTL is decremented before each
# router hop. So at PC:west (TTL=3) -> R1 routed to GRE
# tunnel (TTL=2) -> frame egresses tunnel -> R3 where it
# is routed to PC:east (TTL=1).
#
# If outer TTL was inherited (TTL=2), packet would be
# dropped at R3.
west_ns.runsh(f"ping -c 3 -t {TEST_TTL} {PC_EAST_HOST}")
with test.step("Verify packets arrived at PC:east"):
packets = pcap.tcpdump()
print("Captured packets on PC:east:")
print(packets)
pings = [line for line in packets.splitlines()
if f"{PC_WEST_HOST} > {PC_EAST_HOST}: ICMP echo request" in line]
assert len(pings) >= 1, f"Expected at least 1 ping, got {len(pings)}."
test.succeed()
test/case/ietf_interfaces/tunnel_ttl/test.yaml
+11
View File
@@ -0,0 +1,11 @@
---
- settings:
test-spec: <case>.adoc
- name: GRE Tunnel TTL verification
case: gre.py
opts: ["--tunnel", "gre"]
- name: VXLAN Tunnel TTL verification
case: vxlan.py
opts: ["--tunnel", "vxlan"]
test/case/ietf_interfaces/tunnel_ttl/topology.dot
+41
View File
@@ -0,0 +1,41 @@
graph "tunnel-ttl-3dut" {
layout="neato";
overlap="false";
esep="+60";
node [shape=record, fontname="DejaVu Sans Mono, Book"];
edge [color="cornflowerblue", penwidth="2", fontname="DejaVu Serif, Book"];
PC [
label="<mgmt1> mgmt1 | <west> west | <mgmt2> mgmt2 | <mgmt3> mgmt3 | <east> east | { PC }"
pos="10,0!",
requires="controller",
];
R1 [
label="R1 | <mgmt> mgmt | <west> west | <east> east",
pos="0, -5!",
requires="infix",
];
R2 [
label="<west> west | R2 | <mgmt> mgmt | <east> east",
pos="10, -5!",
requires="infix",
];
R3 [
label="<west> west | R3 | <mgmt> mgmt | <east> east",
pos="20, -5!",
requires="infix",
];
PC:mgmt1 -- R1:mgmt [requires="mgmt", color="lightgray"]
PC:mgmt2 -- R2:mgmt [requires="mgmt", color="lightgray"]
PC:mgmt3 -- R3:mgmt [requires="mgmt", color="lightgray"]
PC:west -- R1:west [headlabel=".1", label="192.168.10.0/24", taillabel=".2", labeldistance=2, fontcolor="black", color="black"]
R1:east -- R2:west [headlabel=".1", label="192.168.50.0/24", taillabel=".2", labeldistance=2, fontcolor="black", color="blue"]
R2:east -- R3:west [headlabel=".1", label="192.168.60.0/24", taillabel=".2", labeldistance=2, fontcolor="black", color="blue"]
R3:east -- PC:east [headlabel=".1", label="192.168.70.0/24", taillabel=".2", labeldistance=2, fontcolor="black", color="black"]
}
test/case/ietf_interfaces/tunnel_ttl/topology.svg
+111
View File
@@ -0,0 +1,111 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<!-- Title: tunnel&#45;ttl&#45;3dut Pages: 1 -->
<svg width="939pt" height="232pt"
viewBox="0.00 0.00 939.07 232.02" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 228.02)">
<title>tunnel&#45;ttl&#45;3dut</title>
<polygon fill="white" stroke="transparent" points="-4,4 -4,-228.02 935.07,-228.02 935.07,4 -4,4"/>
<!-- PC -->
<g id="node1" class="node">
<title>PC</title>
<polygon fill="none" stroke="black" points="312.04,-187.52 312.04,-223.52 619.04,-223.52 619.04,-187.52 312.04,-187.52"/>
<text text-anchor="middle" x="341.04" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt1</text>
<polyline fill="none" stroke="black" points="370.04,-187.52 370.04,-223.52 "/>
<text text-anchor="middle" x="395.04" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">west</text>
<polyline fill="none" stroke="black" points="420.04,-187.52 420.04,-223.52 "/>
<text text-anchor="middle" x="449.04" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt2</text>
<polyline fill="none" stroke="black" points="478.04,-187.52 478.04,-223.52 "/>
<text text-anchor="middle" x="507.04" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt3</text>
<polyline fill="none" stroke="black" points="536.04,-187.52 536.04,-223.52 "/>
<text text-anchor="middle" x="561.04" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">east</text>
<polyline fill="none" stroke="black" points="586.04,-187.52 586.04,-223.52 "/>
<text text-anchor="middle" x="602.54" y="-201.82" font-family="DejaVu Sans Mono, Book" font-size="14.00">PC</text>
</g>
<!-- R1 -->
<g id="node2" class="node">
<title>R1</title>
<polygon fill="none" stroke="black" points="0,-0.5 0,-36.5 183,-36.5 183,-0.5 0,-0.5"/>
<text text-anchor="middle" x="16.5" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">R1</text>
<polyline fill="none" stroke="black" points="33,-0.5 33,-36.5 "/>
<text text-anchor="middle" x="58" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
<polyline fill="none" stroke="black" points="83,-0.5 83,-36.5 "/>
<text text-anchor="middle" x="108" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">west</text>
<polyline fill="none" stroke="black" points="133,-0.5 133,-36.5 "/>
<text text-anchor="middle" x="158" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">east</text>
</g>
<!-- PC&#45;&#45;R1 -->
<g id="edge1" class="edge">
<title>PC:mgmt1&#45;&#45;R1:mgmt</title>
<path fill="none" stroke="lightgray" stroke-width="2" d="M311.54,-205.52C311.54,-205.52 57.5,-36.5 57.5,-36.5"/>
</g>
<!-- PC&#45;&#45;R1 -->
<g id="edge4" class="edge">
<title>PC:west&#45;&#45;R1:west</title>
<path fill="none" stroke="black" stroke-width="2" d="M394.54,-187.52C394.54,-187.52 108.5,-36.5 108.5,-36.5"/>
<text text-anchor="middle" x="192.52" y="-115.81" font-family="DejaVu Serif, Book" font-size="14.00">192.168.10.0/24</text>
<text text-anchor="middle" x="128.48" y="-33.79" font-family="DejaVu Serif, Book" font-size="14.00">.1</text>
<text text-anchor="middle" x="374.56" y="-182.83" font-family="DejaVu Serif, Book" font-size="14.00">.2</text>
</g>
<!-- R2 -->
<g id="node3" class="node">
<title>R2</title>
<polygon fill="none" stroke="black" points="374.04,-0.5 374.04,-36.5 557.04,-36.5 557.04,-0.5 374.04,-0.5"/>
<text text-anchor="middle" x="399.04" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">west</text>
<polyline fill="none" stroke="black" points="424.04,-0.5 424.04,-36.5 "/>
<text text-anchor="middle" x="440.54" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">R2</text>
<polyline fill="none" stroke="black" points="457.04,-0.5 457.04,-36.5 "/>
<text text-anchor="middle" x="482.04" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
<polyline fill="none" stroke="black" points="507.04,-0.5 507.04,-36.5 "/>
<text text-anchor="middle" x="532.04" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">east</text>
</g>
<!-- PC&#45;&#45;R2 -->
<g id="edge2" class="edge">
<title>PC:mgmt2&#45;&#45;R2:mgmt</title>
<path fill="none" stroke="lightgray" stroke-width="2" d="M448.54,-187.52C448.54,-187.52 482.54,-36.5 482.54,-36.5"/>
</g>
<!-- R3 -->
<g id="node4" class="node">
<title>R3</title>
<polygon fill="none" stroke="black" points="748.07,-0.5 748.07,-36.5 931.07,-36.5 931.07,-0.5 748.07,-0.5"/>
<text text-anchor="middle" x="773.07" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">west</text>
<polyline fill="none" stroke="black" points="798.07,-0.5 798.07,-36.5 "/>
<text text-anchor="middle" x="814.57" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">R3</text>
<polyline fill="none" stroke="black" points="831.07,-0.5 831.07,-36.5 "/>
<text text-anchor="middle" x="856.07" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">mgmt</text>
<polyline fill="none" stroke="black" points="881.07,-0.5 881.07,-36.5 "/>
<text text-anchor="middle" x="906.07" y="-14.8" font-family="DejaVu Sans Mono, Book" font-size="14.00">east</text>
</g>
<!-- PC&#45;&#45;R3 -->
<g id="edge3" class="edge">
<title>PC:mgmt3&#45;&#45;R3:mgmt</title>
<path fill="none" stroke="lightgray" stroke-width="2" d="M507.54,-187.52C507.54,-187.52 856.57,-36.5 856.57,-36.5"/>
</g>
<!-- R1&#45;&#45;R2 -->
<g id="edge5" class="edge">
<title>R1:east&#45;&#45;R2:west</title>
<path fill="none" stroke="blue" stroke-width="2" d="M183.5,-18.5C183.5,-18.5 373.54,-18.5 373.54,-18.5"/>
<text text-anchor="middle" x="308.02" y="-7.3" font-family="DejaVu Serif, Book" font-size="14.00">192.168.50.0/24</text>
<text text-anchor="middle" x="355.41" y="-23.25" font-family="DejaVu Serif, Book" font-size="14.00">.1</text>
<text text-anchor="middle" x="201.63" y="-6.35" font-family="DejaVu Serif, Book" font-size="14.00">.2</text>
</g>
<!-- R2&#45;&#45;R3 -->
<g id="edge6" class="edge">
<title>R2:east&#45;&#45;R3:west</title>
<path fill="none" stroke="blue" stroke-width="2" d="M557.54,-18.5C557.54,-18.5 747.57,-18.5 747.57,-18.5"/>
<text text-anchor="middle" x="682.06" y="-7.3" font-family="DejaVu Serif, Book" font-size="14.00">192.168.60.0/24</text>
<text text-anchor="middle" x="729.45" y="-23.25" font-family="DejaVu Serif, Book" font-size="14.00">.1</text>
<text text-anchor="middle" x="575.66" y="-6.35" font-family="DejaVu Serif, Book" font-size="14.00">.2</text>
</g>
<!-- R3&#45;&#45;PC -->
<g id="edge7" class="edge">
<title>R3:east&#45;&#45;PC:east</title>
<path fill="none" stroke="black" stroke-width="2" d="M906.57,-36.5C906.57,-36.5 561.54,-187.52 561.54,-187.52"/>
<text text-anchor="middle" x="675.06" y="-115.81" font-family="DejaVu Serif, Book" font-size="14.00">192.168.70.0/24</text>
<text text-anchor="middle" x="574.75" y="-168.81" font-family="DejaVu Serif, Book" font-size="14.00">.1</text>
<text text-anchor="middle" x="893.36" y="-47.81" font-family="DejaVu Serif, Book" font-size="14.00">.2</text>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.0 KiB

test/case/ietf_interfaces/tunnel_ttl/vxlan.adoc
+32
View File
@@ -0,0 +1,32 @@
=== VXLAN Tunnel TTL verification
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/ietf_interfaces/tunnel_ttl]
==== Description
Verify that GRE and VXLAN tunnels use a fixed TTL (default 64) for
encapsulated frames instead of inheriting the TTL from inner packets.
Critical for protocols like OSPF that use TTL=1 for their packets.
The test setup creates a tunnel between R1 and R3 so that injecting
a frame with TTL=3 from PC:west, routing it through the tunnel, it
would still reach PC:east. (Had it been routed via R2 it would be too
many hops and the TTL would reach zero before the last routing step.)
PC:west -- R1 -- R2 -- R3 -- PC:east
`== Tunnel =='
==== Topology
image::topology.svg[VXLAN Tunnel TTL verification topology, align=center, scaledwidth=75%]
==== Sequence
. Set up topology and attach to target DUTs
. Configure R1 with vxlan tunnel to R3
. Configure R2 as intermediate router (underlay forwarding)
. Configure R3 with vxlan tunnel to R1
. Send ping from PC:west to PC:east with low TTL
. Verify packets arrived at PC:east
test/case/ietf_interfaces/tunnel_ttl/vxlan.py
Symlink
+1
View File
@@ -0,0 +1 @@
test.py
test/case/ietf_interfaces/tunnels.yaml
+3
View File
@@ -4,3 +4,6 @@
- name: Tunnel interface bridged with physical
suite: tunnel_bridged/test.yaml
- name: Tunnel TTL verification
suite: tunnel_ttl/test.yaml
test/case/infix_firewall/basic/topology.svg
+1 -2
View File
@@ -1,8 +1,7 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<!-- Generated by graphviz version 2.43.0 (0)
-->
<!-- Title: 1x3 Pages: 1 -->
<svg width="381pt" height="191pt"
viewBox="0.00 0.00 381.03 190.72" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 3.4 KiB

After

Width:  |  Height:  |  Size: 3.3 KiB