AltraMayor / AltraMayor/gatekeeper

Support running Gatekeeper and Grantor on KVM

Ouverte
#464 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
enhancement
Langage dominant
C
Étoiles
1.6k
Forks
252
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

While running Gatekeeper on KVM, a couple of issues have been identified.

The following log entry is likely the biggest issue here since it means that Gatekeeper is not properly parsing packets.
`GATEKEEPER: l2: gk: invalid Ethernet field or frame not Ethernet II:38`
The current L2 implementation in Gatekeeper doesn't support alternatives to Ethernet II.

IPv6 multicast addresses in the format `0x33-33-mm-mm-mm-mm` are not being properly handled. Log entry example:
```
GATEKEEPER: acl: a packet failed to match any ACL rules, the whole packet is dumped below:
dump mbuf at 0x10f09c040, iova=5769c0d0, buf_len=2176
pkt_len=90, ol_flags=0, nb_segs=1, in_port=1
segment at 0x10f09c040, data=0x10f09c150, data_len=90
Dump data at [0x10f09c150], len=90
00000000: 33 33 00 00 00 16 FE 54 00 4B 73 5F 86 DD 60 00 | 33.....T.Ks_..`.
00000010: 00 00 00 24 00 01 00 00 00 00 00 00 00 00 00 00 | ...$............
00000020: 00 00 00 00 00 00 FF 02 00 00 00 00 00 00 00 00 | ................
00000030: 00 00 00 00 00 16 3A 00 05 02 00 00 01 00 8F 00 | ......:.........
00000040: FB DF 00 00 00 01 04 00 00 00 FF 02 00 00 00 00 | ................
00000050: 00 00 00 00 00 01 FF 4B 73 5F | .......Ks_
```
Information about these multicast addresses can be found in the article [Mapping IPv6 Multicast Addresses to Ethernet Addresses](https://flylib.com/books/en/2.223.1.44/1/). One has to investigate if Gatekeeper has to do something with these packets or just silently dropping them.

See [this Gatekeeper log](https://github.com/AltraMayor/gatekeeper/files/6266772/gatekeeper_2021_04_05_19_36.log) for examples of the issues described above.

Supporting KVM will enable Gatekeeper to be deployed on more cloud providers and be an easier alternative to test Gatekeeper.

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.