pull request (net-next): ipsec-next 2014-12-03

PATCH New Steffen Klassert 2 participants 7 messages Dec 3, 2014 – Dec 9, 2014

Subsystems (4)

Networking Network drivers IPv4/IPv6 Networking IPsec

lore

Share & tools

lore

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #0 lore raw

1) Fix a set but not used warning. From Fabian Frederick.

2) Currently we make sequence number values available to userspace only if we use ESN. Make the sequence number values also available for non ESN states. From Zhi Ding.

3) Remove socket policy hashing. We don't need it because socket policies are always looked up via a linked list. From Herbert Xu.

4) After removing socket policy hashing, we can use __xfrm_policy_link in xfrm_policy_insert. From Herbert Xu.

5) Add a lookup method for vti6 tunnels with wildcard endpoints. I forgot this when I initially implemented vti6.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 49cc91f919e2a94df8c9f99aae9b405444e88624:

Merge branch 's390-next' (2014-10-26 22:21:45 -0400)

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master

for you to fetch changes up to fbe68ee87522f6eaa10f9076c0a7117e1613f2f7:

vti6: Add a lookup method for tunnels with wildcard endpoints. (2014-11-20 10:03:07 +0100)

----------------------------------------------------------------
Fabian Frederick (1):
xfrm: fix set but not used warning in xfrm_policy_queue_process()

Herbert Xu (2):
xfrm: Do not hash socket policies
xfrm: Use __xfrm_policy_link in xfrm_policy_insert

Steffen Klassert (1):
vti6: Add a lookup method for tunnels with wildcard endpoints.

dingzhi (1):
xfrm: add XFRMA_REPLAY_VAL attribute to SA messages

 include/net/netns/xfrm.h |  4 ++--
 net/ipv6/ip6_vti.c       | 17 ++++++++++++++++
 net/xfrm/xfrm_policy.c   | 52 +++++++++++++++++++++++++++---------------------
 net/xfrm/xfrm_user.c     | 12 +++++++----
 4 files changed, 56 insertions(+), 29 deletions(-)

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #1 lore raw

PATCH 1/5 xfrm: fix set but not used warning in xfrm_policy_queue_process()

From: Fabian Frederick <[email protected]>

err was set but unused.

Signed-off-by Fabian Frederick <[email protected]>

Signed-off-by Steffen Klassert <[email protected]>

---
 net/xfrm/xfrm_policy.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

net/xfrm/xfrm_policy.c +1 -2

index 4c4e457..dc65324 100644
@@ -1878,7 +1878,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
 static void xfrm_policy_queue_process(unsigned long arg)
 {
-	int err = 0;
 	struct sk_buff *skb;
 	struct sock *sk;
 	struct dst_entry *dst;

@@ -1941,7 +1940,7 @@ static void xfrm_policy_queue_process(unsigned long arg)
 		skb_dst_drop(skb);
 		skb_dst_set(skb, dst);
 
-		err = dst_output(skb);
+		dst_output(skb);
 	}
 
 out:

Signature · 1 line

1.9.1

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #2 lore raw

PATCH 2/5 xfrm: add XFRMA_REPLAY_VAL attribute to SA messages

In reply to Steffen Klassert

From: dingzhi <[email protected]>

After this commit, the attribute XFRMA_REPLAY_VAL is added when no ESN replay value is defined. Thus sequence number values are always notified to userspace.

Signed-off-by dingzhi <[email protected]>

Signed-off-by Adrien Mazarguil <[email protected]>

Signed-off-by Nicolas Dichtel <[email protected]>

Signed-off-by Steffen Klassert <[email protected]>

---
 net/xfrm/xfrm_user.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

net/xfrm/xfrm_user.c +8 -4

index e812e98..8128594 100644
@@ -824,13 +824,15 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
 	ret = xfrm_mark_put(skb, &x->mark);
 	if (ret)
 		goto out;
-	if (x->replay_esn) {
+	if (x->replay_esn)
 		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
 			      xfrm_replay_state_esn_len(x->replay_esn),
 			      x->replay_esn);
-		if (ret)
-			goto out;
-	}
+	else
+		ret = nla_put(skb, XFRMA_REPLAY_VAL, sizeof(x->replay),
+			      &x->replay);
+	if (ret)
+		goto out;
 	if (x->security)
 		ret = copy_sec_ctx(x->security, skb);
 out:

@@ -2569,6 +2571,8 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
 		l += nla_total_size(sizeof(x->tfcpad));
 	if (x->replay_esn)
 		l += nla_total_size(xfrm_replay_state_esn_len(x->replay_esn));
+	else
+		l += nla_total_size(sizeof(struct xfrm_replay_state));
 	if (x->security)
 		l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
 				    x->security->ctx_len);

Signature · 1 line

1.9.1

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #3 lore raw

PATCH 3/5 xfrm: Do not hash socket policies

In reply to Steffen Klassert

From: Herbert Xu <[email protected]>

Back in 2003 when I added policy expiration, I half-heartedly did a clean-up and renamed xfrm_sk_policy_link/xfrm_sk_policy_unlink to __xfrm_policy_link/__xfrm_policy_unlink, because the latter could be reused for all policies. I never actually got around to using __xfrm_policy_link for non-socket policies.

Later on hashing was added to all xfrm policies, including socket policies. In fact, we don't need hashing on socket policies at all since they're always looked up via a linked list.

This patch restores xfrm_sk_policy_link/xfrm_sk_policy_unlink as wrappers around __xfrm_policy_link/__xfrm_policy_unlink so that it's obvious we're dealing with socket policies.

This patch also removes hashing from __xfrm_policy_link as for now it's only used by socket policies which do not need to be hashed. Ironically this will in fact allow us to use this helper for non-socket policies which I shall do later.

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Steffen Klassert <[email protected]>

---
 include/net/netns/xfrm.h |  4 ++--
 net/xfrm/xfrm_policy.c   | 44 ++++++++++++++++++++++++++------------------
 2 files changed, 28 insertions(+), 20 deletions(-)

include/net/netns/xfrm.h +2 -2

index 9da7982..730d82a 100644
@@ -50,8 +50,8 @@ struct netns_xfrm {
 	struct list_head	policy_all;
 	struct hlist_head	*policy_byidx;
 	unsigned int		policy_idx_hmask;
-	struct hlist_head	policy_inexact[XFRM_POLICY_MAX * 2];
-	struct xfrm_policy_hash	policy_bydst[XFRM_POLICY_MAX * 2];
+	struct hlist_head	policy_inexact[XFRM_POLICY_MAX];
+	struct xfrm_policy_hash	policy_bydst[XFRM_POLICY_MAX];
 	unsigned int		policy_count[XFRM_POLICY_MAX * 2];
 	struct work_struct	policy_hash_work;
 	struct xfrm_policy_hthresh policy_hthresh;

net/xfrm/xfrm_policy.c +26 ~~-18~~

112 lines not on this page · raw message

Signature · 1 line

1.9.1

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #4 lore raw

PATCH 4/5 xfrm: Use __xfrm_policy_link in xfrm_policy_insert

In reply to Steffen Klassert

From: Herbert Xu <[email protected]>

For a long time we couldn't actually use __xfrm_policy_link in xfrm_policy_insert because the latter wanted to do hashing at a specific position.

Now that __xfrm_policy_link no longer does hashing it can now be safely used in xfrm_policy_insert to kill some duplicate code, finally reuniting general policies with socket policies.

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Steffen Klassert <[email protected]>

---
 net/xfrm/xfrm_policy.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

net/xfrm/xfrm_policy.c +2 -3

index f4d3a12..178fa0e 100644
@@ -55,6 +55,7 @@ static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
 static void xfrm_policy_queue_process(unsigned long arg);
 
+static void __xfrm_policy_link(struct xfrm_policy *pol, int dir);
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
 						int dir);

@@ -779,8 +780,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 		hlist_add_behind(&policy->bydst, newpos);
 	else
 		hlist_add_head(&policy->bydst, chain);
-	xfrm_pol_hold(policy);
-	net->xfrm.policy_count[dir]++;
+	__xfrm_policy_link(policy, dir);
 	atomic_inc(&net->xfrm.flow_cache_genid);
 
 	/* After previous checking, family can either be AF_INET or AF_INET6 */

@@ -799,7 +799,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 	policy->curlft.use_time = 0;
 	if (!mod_timer(&policy->timer, jiffies + HZ))
 		xfrm_pol_hold(policy);
-	list_add(&policy->walk.all, &net->xfrm.policy_all);
 	write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 
 	if (delpol)

Signature · 1 line

1.9.1

Steffen Klassert

author maintainer

2014-12-03 10:05 UTC #5 lore raw

PATCH 5/5 vti6: Add a lookup method for tunnels with wildcard endpoints.

In reply to Steffen Klassert

Currently we can't lookup tunnels with wildcard endpoints. This patch adds a method to lookup these tunnels in the receive path.

Signed-off-by Steffen Klassert <[email protected]>

---
 net/ipv6/ip6_vti.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

net/ipv6/ip6_vti.c +17 -0

index d440bb5..6101919 100644
@@ -95,6 +95,7 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote,
 	unsigned int hash = HASH(remote, local);
 	struct ip6_tnl *t;
 	struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+	struct in6_addr any;
 
 	for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 		if (ipv6_addr_equal(local, &t->parms.laddr) &&

@@ -102,6 +103,22 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote,
 		    (t->dev->flags & IFF_UP))
 			return t;
 	}
+
+	memset(&any, 0, sizeof(any));
+	hash = HASH(&any, local);
+	for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+		if (ipv6_addr_equal(local, &t->parms.laddr) &&
+		    (t->dev->flags & IFF_UP))
+			return t;
+	}
+
+	hash = HASH(remote, &any);
+	for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+		if (ipv6_addr_equal(remote, &t->parms.raddr) &&
+		    (t->dev->flags & IFF_UP))
+			return t;
+	}
+
 	t = rcu_dereference(ip6n->tnls_wc[0]);
 	if (t && (t->dev->flags & IFF_UP))
 		return t;

Signature · 1 line

1.9.1

David Miller

maintainer

2014-12-09 02:30 UTC #6 lore raw

In reply to Steffen Klassert

From: Steffen Klassert <[email protected]>
Date: Wed, 3 Dec 2014 11:04:56 +0100

Quoted 9 lines

1) Fix a set but not used warning. From Fabian Frederick.
2) Currently we make sequence number values available to userspace only if we use ESN. Make the sequence number values also available for non ESN states. From Zhi Ding.
3) Remove socket policy hashing. We don't need it because socket policies are always looked up via a linked list. From Herbert Xu.

Quoted 7 lines

4) After removing socket policy hashing, we can use __xfrm_policy_link in xfrm_policy_insert. From Herbert Xu.
5) Add a lookup method for vti6 tunnels with wildcard endpoints. I forgot this when I initially implemented vti6.
Please pull or let me know if there are problems.

Pulled, thanks a lot Steffen.