xfrm ip6ip6

Hello,

Here is the xfrm style ip6ip6 patch,
which is against linux-2.5.70+CS1.1254.2.15.

I honestly have to say it is not tested well.
But I promise I'll test/fix after xfrm tunnel tool will be visible :-) (Does anyone work on this?)

Anyway, I have one discussion point.
When we use 'setkey -D', xfrm ipip tunnels are displayed as unspec SAs. Do we need to filter out these xfrm_states other than AH/ESP/IPcomp in case of PF_KEY based queries?

Regards,
-mk

Index: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/include/net/xfrm.h
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/include/net/xfrm.h,v retrieving revision 1.1.1.23
retrieving revision 1.1.1.23.10.1

diff -u -r1.1.1.23 -r1.1.1.23.10.1
@@ -493,8 +493,16 @@
 }
 
 /* placeholder until xfrm6_tunnel.c is written */
-static inline int xfrm6_tunnel_check_size(struct sk_buff *skb)
-{ return 0; }
+extern int xfrm6_tunnel_check_size(struct sk_buff *skb);
+#define XFRM_ADDR_HSIZE		1024
+static __inline__ /* same as __xfrm6_dst_hash */
+unsigned xfrm6_tunnel_addr_hash(xfrm_address_t *addr)
+{
+	unsigned h;
+	h = ntohl(addr->a6[2]^addr->a6[3]);
+	h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
+	return h;
+}
 
 /* A struct encoding bundle of transformations to apply to some set of flow.
  *

Index: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/net/ipv6/Makefile
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/Makefile,v retrieving revision 1.1.1.12
retrieving revision 1.1.1.12.10.1

diff -u -r1.1.1.12 -r1.1.1.12.10.1
@@ -9,7 +9,7 @@
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
 		ip6_flowlabel.o ipv6_syms.o \
-		xfrm6_policy.o xfrm6_state.o xfrm6_input.o
+		xfrm6_policy.o xfrm6_state.o xfrm6_input.o xfrm6_tunnel.o
 
 obj-$(CONFIG_INET6_AH) += ah6.o
 obj-$(CONFIG_INET6_ESP) += esp6.o

Index: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/net/ipv6/ipcomp6.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/ipcomp6.c,v retrieving revision 1.1.1.2
retrieving revision 1.1.1.2.8.2

Index: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/net/ipv6/xfrm6_tunnel.c
===================================================================
RCS file: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/net/ipv6/xfrm6_tunnel.c

Index: linux25-b2_5_70+CS1_1254_2_15_XFRM6_TUNNEL_20030531/net/xfrm/xfrm_output.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/xfrm/xfrm_output.c,v retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.16.1

diff -u -r1.1.1.1 -r1.1.1.1.16.1
@@ -28,9 +28,11 @@
 			err = xfrm4_tunnel_check_size(skb);
 			break;
 			
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 		case AF_INET6:
 			err = xfrm6_tunnel_check_size(skb);
 			break;
+#endif
 			
 		default:
 			err = -EINVAL;

Good question. We need to either filter them out or make sure they are displayed as ipip.

Part of the answer will depend on whether we want to expose xfrm-based ipip tunnels for general use, or only use them internally for ipcomp.

- James

James Morris
<[email protected]>

From: James Morris <[email protected]>
Date: Sun, 1 Jun 2003 02:01:42 +1000 (EST)

We need to either filter them out or make sure they are displayed as ipip.

Part of the answer will depend on whether we want to expose xfrm-based ipip tunnels for general use, or only use them internally for ipcomp.

I think it is an error to extend PF_KEY for our Linux purposes. Our API here is basically defined to be whatever is in KAME :-)

However, setkey should filter entries it does not understand.

Currently I see no use for exposing these tunnel transforms outside of the kernel. Mobile IPV6, if it decides to use xfrm6_tunnel, can configure them itself in the kernel side support. Or, if user side is more appropriate for MIPV6 access, we may allow it to use xfrm netlink interface somehow.

Btw, one simple way to test the xfrm tunneling is to set up a plain ipcomp tunnel and run ssh or https over it, which should cause non-compressed packets to be sent (they will fail the compressability test).

- James

James Morris
<[email protected]>

From: Mitsuru KANDA / 神田 充 <[email protected]>
Date: Sun, 01 Jun 2003 00:20:07 +0900

Hello Mitsuru-san!

   +	t->id.spi = xfrm6_tunnel_addr_hash((xfrm_address_t *)&x->props.saddr);

You misunderstood what I tried to explain to you.

Consider, how do you guarentee that this t->id.spi value is unique across all xfrm6_tunnel tunnels using the same t->id.daddr and t->id.prot? The answer is that you cannot.

You must generate fake "spi" values, they have no meaning outside of xfrm6_tunnel.c They serve purpose only to map 128-bit ipv6 address to 32-bit "xfrm6_tunnel" SPI value.

I would suggest following implementation:

1) Implement something similar to xfrm_alloc_spi(t, 1, ~(u32)0)

It just needs to allocate unique SPI numbers local to
xfrm6_tunnel.c We mark "SPI" value zero as reserved and
to indicate failed lookup.

2) Create hash table, it is keyed by ipv6 address and hash table entries give SPI values.

So on input you would say something like:

	u32 spi;

	spi = spihash_lookup(&iph->saddr);
	if (!spi)
		goto drop;
	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
			      IPPROTO_IPV6, AF_INET6);

Is the idea more clear now?

Once you fix this up I'll apply your xfrm6_tunnel.c work.

Thank you.

Hello,

I recreated a xfrm ip6ip6 patch.
The changes to the previous patch are:
- to allocate unique spi values in xfrm6_tunnel.c by using just simple open addressing hash,
- to introduce device-like ip6ip6 handling, and
- to fix some bugs.

This patch is against CS1.1304.

Chould you check this?

Regards,
-mk

At Sun, 01 Jun 2003 01:30:40 -0700 (PDT),
"David S. Miller" <[email protected]> wrote:
(snipped)

(snipped)

Index: linux25-XFRM6_TUNNEL-20030612/include/net/xfrm.h
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/include/net/xfrm.h,v retrieving revision 1.1.1.25
retrieving revision 1.1.1.25.2.1

diff -u -r1.1.1.25 -r1.1.1.25.2.1
@@ -494,10 +494,6 @@
 	return 0;
 }
 
-/* placeholder until xfrm6_tunnel.c is written */
-static inline int xfrm6_tunnel_check_size(struct sk_buff *skb)
-{ return 0; }
-
 /* A struct encoding bundle of transformations to apply to some set of flow.
  *
  * dst->child points to the next element of bundle.

@@ -748,6 +744,12 @@
 	void (*err_handler)(struct sk_buff *skb, void *info);
 };
 
+struct xfrm6_tunnel {
+	int (*handler)(struct sk_buff **pskb, unsigned int *nhoffp);
+	void (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
+			    int type, int code, int offset, __u32 info);
+};
+
 extern void xfrm_init(void);
 extern void xfrm4_init(void);
 extern void xfrm4_fini(void);

@@ -781,6 +783,11 @@
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
 extern int xfrm4_tunnel_check_size(struct sk_buff *skb);
+extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
+extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
+extern int xfrm6_tunnel_check_size(struct sk_buff *skb);
+extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
+extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
 extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
 extern int xfrm6_clear_mutable_options(struct sk_buff *skb, u16 *nh_offset, int dir);
 extern int xfrm_user_policy(struct sock *sk, int optname, u8 *optval, int optlen);

Index: linux25-XFRM6_TUNNEL-20030612/net/ipv6/Makefile
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/Makefile,v retrieving revision 1.1.1.13
retrieving revision 1.1.1.13.2.1

diff -u -r1.1.1.13 -r1.1.1.13.2.1
@@ -9,7 +9,7 @@
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
 		ip6_flowlabel.o ipv6_syms.o \
-		xfrm6_policy.o xfrm6_state.o xfrm6_input.o
+		xfrm6_policy.o xfrm6_state.o xfrm6_input.o xfrm6_tunnel.o
 
 obj-$(CONFIG_INET6_AH) += ah6.o
 obj-$(CONFIG_INET6_ESP) += esp6.o

Index: linux25-XFRM6_TUNNEL-20030612/net/ipv6/ip6_tunnel.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/ip6_tunnel.c,v retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.2.1

diff -u -r1.1.1.1 -r1.1.1.1.2.1
@@ -48,6 +48,7 @@
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
 #include <net/ip6_tunnel.h>
+#include <net/xfrm.h>
 
 MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6-in-IPv6 tunnel");

@@ -1174,10 +1175,9 @@
 	return 0;
 }
 
-static struct inet6_protocol ip6ip6_protocol = {
+static struct xfrm_tunnel ip6ip6_handler = {
 	.handler = ip6ip6_rcv,
 	.err_handler = ip6ip6_err,
-	.flags = INET6_PROTO_FINAL
 };
 
 /**

@@ -1192,6 +1192,11 @@
 	struct sock *sk;
 	struct ipv6_pinfo *np;
 
+	if (xfrm6_tunnel_register(&ip6ip6_handler) < 0) {
+		printk(KERN_INFO "ip6ip6 init: can't register tunnel\n");
+		return -EAGAIN;
+	}
+
 	ip6ip6_fb_tnl_dev.priv = (void *) &ip6ip6_fb_tnl;
 
 	for (i = 0; i < NR_CPUS; i++) {

@@ -1216,10 +1221,6 @@
 
 		sk->sk_prot->unhash(sk);
 	}
-	if ((err = inet6_add_protocol(&ip6ip6_protocol, IPPROTO_IPV6)) < 0) {
-		printk(KERN_ERR "Failed to register IPv6 protocol\n");
-		goto fail;
-	}
 
 	SET_MODULE_OWNER(&ip6ip6_fb_tnl_dev);
 	register_netdev(&ip6ip6_fb_tnl_dev);

@@ -1243,9 +1244,10 @@
 {
 	int i;
 
-	unregister_netdev(&ip6ip6_fb_tnl_dev);
+	if (xfrm6_tunnel_deregister(&ip6ip6_handler) < 0)
+		printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
-	inet6_del_protocol(&ip6ip6_protocol, IPPROTO_IPV6);
+	unregister_netdev(&ip6ip6_fb_tnl_dev);
 
 	for (i = 0; i < NR_CPUS; i++) {
 		if (!cpu_possible(i))

Index: linux25-XFRM6_TUNNEL-20030612/net/ipv6/ipcomp6.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/ipcomp6.c,v retrieving revision 1.1.1.3

Index: linux25-XFRM6_TUNNEL-20030612/net/ipv6/ipv6_syms.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/ipv6/ipv6_syms.c,v retrieving revision 1.1.1.13
retrieving revision 1.1.1.13.2.1

diff -u -r1.1.1.13 -r1.1.1.13.2.1
@@ -38,6 +38,11 @@
 EXPORT_SYMBOL(ip6_find_1stfragopt);
 EXPORT_SYMBOL(xfrm6_rcv);
 EXPORT_SYMBOL(xfrm6_clear_mutable_options);
+EXPORT_SYMBOL(xfrm6_tunnel_register);
+EXPORT_SYMBOL(xfrm6_tunnel_deregister);
+EXPORT_SYMBOL(xfrm6_tunnel_check_size);
+EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
+EXPORT_SYMBOL(xfrm6_tunnel_spi_lookup);
 EXPORT_SYMBOL(rt6_lookup);
 EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_ext_hdr);

Index: linux25-XFRM6_TUNNEL-20030612/net/ipv6/xfrm6_tunnel.c
===================================================================
RCS file: linux25-XFRM6_TUNNEL-20030612/net/ipv6/xfrm6_tunnel.c

Index: linux25-XFRM6_TUNNEL-20030612/net/xfrm/xfrm_output.c
===================================================================
RCS file: /cvsroot/usagi/usagi-backport/linux25/net/xfrm/xfrm_output.c,v retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.24.1

diff -u -r1.1.1.1 -r1.1.1.1.24.1
@@ -27,11 +27,11 @@
 		case AF_INET:
 			err = xfrm4_tunnel_check_size(skb);
 			break;
-			
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)			
 		case AF_INET6:
 			err = xfrm6_tunnel_check_size(skb);
 			break;
-			
+#endif	
 		default:
 			err = -EINVAL;
 		}

In article <[email protected]> (at Sat, 14 Jun 2003 01:03:50 +0900), Mitsuru KANDA / 神田 充 <[email protected]> says:

Kanda-san, would you use the dynamic netdev allication scheme by alloc_netdev(), please? :-)

Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

In article <[email protected]> (at Sat, 14 Jun 2003 01:11:46 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <[email protected]> says:

Oops, this comment is absolitely wrong... Very sorry...

Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

I can do the alloc_netdev() patch :)

-Ville
--
Ville Nuorvala
Research Assistant, Institute of Digital Communications, Helsinki University of Technology
email: [email protected], phone: +358 (0)9 451 5257

From: Mitsuru KANDA / 神田 充 <[email protected]>
Date: Sat, 14 Jun 2003 01:03:50 +0900

- to allocate unique spi values in xfrm6_tunnel.c by using just simple open addressing hash,

Mitsuru, what happens if two tunnels use same address?

Only first one will be found in hash, this is incorrect behavior as it will cause the wrong SPI to be used when packets are really destined for second user of that address.

You need to add refcount to hash table entries, so that SPI can be shared by different xfrm6 tunnels with same address.

From: "David S. Miller" <[email protected]>
Date: Fri, 13 Jun 2003 12:07:02 -0700 (PDT)

You need to add refcount to hash table entries, so that SPI can be shared by different xfrm6 tunnels with same address.

Mitsuru, here is some example code showing what my idea looks like. I apologize for not making something like this for you earlier.

struct v6spi_entry {
	struct v6spi_entry *next;
	struct in6_addr addr;
	u32 spi;
	atomic_t refcnt;
};

u32 spi v6spi_alloc(struct in6_addr *addr)

{
	int h = v6_hashfn(addr);
	struct v6spi_entry *ent;

	for (ent = hash_table[h]; ent; ent = ent->next) {
		if (!ipv6_addr_cmp(addr, &ent->addr)) {
			atomic_inc(&ent->refcnt);
			return ent->spi;
		}
	}
	ent = kmalloc(sizeof(*ent), GFP_ATOMIC);
	ent->spi = alloc_unique_spi();
	ipv6_addr_copy(&ent->addr, addr);
	atomic_set(&ent->refcnt, 1);
	ent->next = hash_table[h];
	hash_table[h] = ent;

	return ent->spi;
}