* Re: [PATCH net-next-2.6 0/5] XFRM,IPv6: Removal of RH2/HAO from IPsec-protected MIPv6 traffic
From: Arnaud Ebalard @ 2010-09-24 19:34 UTC (permalink / raw)
To: netdev
In-Reply-To: <20100924.120156.115937401.davem@davemloft.net>
Hi,
David Miller <davem@davemloft.net> writes:
>> [This is a resend: after 6 hours, nothing appeared on the list. Sorry
>> if you received it twice]
>
> They didn't appear on the list because your email header fields
> are all screwed up, I forwarded the bounce messages to you twice
> under seperate cover.
Sorry for that. I decided to mangle email addresses by hand. That was a
baaaaaaad idea.
a+
^ permalink raw reply
* Re: [PATCH 15/24] net: change to new flag variable
From: John W. Linville @ 2010-09-24 19:25 UTC (permalink / raw)
To: matt mooney
Cc: kernel-janitors, Sjur Braendeland, Jouni Malinen, Daniel Drake,
Ulrich Kunitz, netdev, linux-kernel, linux-wireless
In-Reply-To: <facbf79cadc81f9043e89160b7b3b8a90926aba1.1285355033.git.mfm@muteddisk.com>
On Fri, Sep 24, 2010 at 12:17:25PM -0700, matt mooney wrote:
> Replace EXTRA_CFLAGS with ccflags-y.
>
> Signed-off-by: matt mooney <mfm@muteddisk.com>
> ---
> drivers/net/wireless/hostap/hostap_config.h | 4 ++--
> drivers/net/wireless/zd1211rw/Makefile | 4 +---
ACK for these bits...
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply
* [PATCH net-next-2.6 5/5] XFRM,IPv6: Add IRO remapping capability via socket ancillary data path
From: Arnaud Ebalard @ 2010-09-24 19:26 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
In-Reply-To: <87bp7nrlvy.fsf@small.ssi.corp>
This provides the ability to remap src/dst address using IRO
via ancillary data passed to sockets. This is the IRO equivalent
of what is done for RH2/HAO (i.e. IPV6_RTHDR/IPV6_DSTOPTS).
This is used by UMIP during BA emission when acting as a Home
Agent.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
---
include/net/ipv6.h | 4 ++++
net/ipv6/datagram.c | 20 ++++++++++++++++++++
net/ipv6/exthdrs.c | 19 +++++++++++++------
net/ipv6/ip6_flowlabel.c | 7 +++++++
net/ipv6/ip6_output.c | 22 ++++++++++++++++++++++
net/ipv6/raw.c | 3 ++-
6 files changed, 68 insertions(+), 7 deletions(-)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 1f84124..9dbc4f7 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -188,6 +188,10 @@ struct ipv6_txoptions {
struct ipv6_rt_hdr *srcrt; /* Routing Header */
struct ipv6_opt_hdr *dst1opt;
+ /* XXX protect those via some ifdef e.g. CONFIG_XFRM_SUB_POLICY ? */
+ struct in6_addr *iro_src;
+ struct in6_addr *iro_dst;
+
/* Option buffer, as read by IPV6_PKTOPTIONS, starts here. */
};
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 2952c9e..0ac7adf 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -757,6 +757,26 @@ int datagram_send_ctl(struct net *net,
}
break;
+#ifdef CONFIG_XFRM_SUB_POLICY
+ case IPV6_IROSRC:
+ case IPV6_IRODST:
+ if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_addr))) {
+ err = -EINVAL;
+ goto exit_f;
+ }
+
+ if (!capable(CAP_NET_RAW)) {
+ err = -EPERM;
+ goto exit_f;
+ }
+
+ if (cmsg->cmsg_type == IPV6_IROSRC)
+ opt->iro_src = (struct in6_addr *)CMSG_DATA(cmsg);
+ else
+ opt->iro_dst = (struct in6_addr *)CMSG_DATA(cmsg);
+ break;
+#endif
+
case IPV6_2292RTHDR:
case IPV6_RTHDR:
if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 262f105..e480b06 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -750,6 +750,10 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
*((char**)&opt2->dst1opt) += dif;
if (opt2->srcrt)
*((char**)&opt2->srcrt) += dif;
+ if (opt2->iro_src)
+ *((char**)&opt2->iro_src) += dif;
+ if (opt2->iro_dst)
+ *((char**)&opt2->iro_dst) += dif;
}
return opt2;
}
@@ -874,24 +878,27 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
/**
* fl6_update_dst - update flowi destination address with info given
- * by srcrt option, if any.
+ * by srcrt/iro_dst option, if any.
*
* @fl: flowi for which fl6_dst is to be updated
- * @opt: struct ipv6_txoptions in which to look for srcrt opt
+ * @opt: struct ipv6_txoptions in which to look for srcrt/iro_dst opt
* @orig: copy of original fl6_dst address if modified
*
- * Returns NULL if no txoptions or no srcrt, otherwise returns orig
- * and initial value of fl->fl6_dst set in orig
+ * Returns NULL if no txoptions or no options to change flowi destination
+ * (srcrt or IRO destination remapping rule), otherwise returns orig and
+ * initial value of fl->fl6_dst set in orig
*/
struct in6_addr *fl6_update_dst(struct flowi *fl,
const struct ipv6_txoptions *opt,
struct in6_addr *orig)
{
- if (!opt || !opt->srcrt)
+ if (!opt || (!opt->srcrt && !opt->iro_dst))
return NULL;
ipv6_addr_copy(orig, &fl->fl6_dst);
- ipv6_addr_copy(&fl->fl6_dst, ((struct rt0_hdr *)opt->srcrt)->addr);
+ ipv6_addr_copy(&fl->fl6_dst,
+ opt->iro_dst ?: ((struct rt0_hdr *)opt->srcrt)->addr);
+
return orig;
}
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1365468..dbf9c29 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -280,6 +280,9 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
opt_space->hopopt = fl_opt->hopopt;
opt_space->dst0opt = fl_opt->dst0opt;
opt_space->srcrt = fl_opt->srcrt;
+ /* XXX protect those via some ifdef - see net/ipv6.h */
+ opt_space->iro_src = fl_opt->iro_src;
+ opt_space->iro_dst = fl_opt->iro_dst;
opt_space->opt_nflen = fl_opt->opt_nflen;
} else {
if (fopt->opt_nflen == 0)
@@ -287,6 +290,9 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
opt_space->hopopt = NULL;
opt_space->dst0opt = NULL;
opt_space->srcrt = NULL;
+ /* XXX protect those via some ifdef - see net/ipv6.h */
+ opt_space->iro_src = NULL;
+ opt_space->iro_dst = NULL;
opt_space->opt_nflen = 0;
}
opt_space->dst1opt = fopt->dst1opt;
@@ -456,6 +462,7 @@ static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
return 1;
if (ipv6_hdr_cmp((struct ipv6_opt_hdr *)o1->srcrt, (struct ipv6_opt_hdr *)o2->srcrt))
return 1;
+
return 0;
}
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d40b330..2fbe583 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -222,6 +222,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
ipv6_push_frag_opts(skb, opt, &proto);
if (opt->opt_nflen)
ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
+ if (opt->iro_dst)
+ first_hop = opt->iro_dst;
}
skb_push(skb, sizeof(struct ipv6hdr));
@@ -1098,6 +1100,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}
+static inline struct in6_addr *ip6_iro_addr_dup(struct in6_addr *addr,
+ gfp_t gfp)
+{
+ return addr ? kmemdup(addr, sizeof(struct in6_addr), gfp) : NULL;
+}
+
int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
int offset, int len, int odd, struct sk_buff *skb),
void *from, int length, int transhdrlen,
@@ -1154,6 +1162,16 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
if (opt->srcrt && !np->cork.opt->srcrt)
return -ENOBUFS;
+ np->cork.opt->iro_src = ip6_iro_addr_dup(opt->iro_src,
+ sk->sk_allocation);
+ if (opt->iro_src && !np->cork.opt->iro_src)
+ return -ENOBUFS;
+
+ np->cork.opt->iro_dst = ip6_iro_addr_dup(opt->iro_dst,
+ sk->sk_allocation);
+ if (opt->iro_dst && !np->cork.opt->iro_dst)
+ return -ENOBUFS;
+
/* need source address above miyazawa*/
}
dst_hold(&rt->dst);
@@ -1432,6 +1450,8 @@ static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
kfree(np->cork.opt->dst1opt);
kfree(np->cork.opt->hopopt);
kfree(np->cork.opt->srcrt);
+ kfree(np->cork.opt->iro_src);
+ kfree(np->cork.opt->iro_dst);
kfree(np->cork.opt);
np->cork.opt = NULL;
}
@@ -1487,6 +1507,8 @@ int ip6_push_pending_frames(struct sock *sk)
ipv6_push_frag_opts(skb, opt, &proto);
if (opt && opt->opt_nflen)
ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
+ if (opt && opt->iro_dst)
+ final_dst = opt->iro_dst;
skb_push(skb, sizeof(struct ipv6hdr));
skb_reset_network_header(skb);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e677937..e817d04 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -828,7 +828,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
if (flowlabel == NULL)
return -EINVAL;
}
- if (!(opt->opt_nflen|opt->opt_flen))
+ if (!(opt->opt_nflen|opt->opt_flen) &&
+ (!opt->iro_src && !opt->iro_dst))
opt = NULL;
}
if (opt == NULL)
--
1.7.1
^ permalink raw reply related
* [PATCH net-next-2.6 4/5] XFRM,IPv6: Add IRO remapping hook in xfrm_input()
From: Arnaud Ebalard @ 2010-09-24 19:25 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
In-Reply-To: <87bp7nrlvy.fsf@small.ssi.corp>
Add a hook in xfrm_input() to allow IRO remapping to occur when
an incoming packet matching an existing SA (based on SPI) with
an unexpected destination or source address is received.
Because IRO does not consume additional bits in a packet (that's
the point), there is no way to demultiplex based on something
like nh or spi. Instead, IRO input handlers (for source and
destination address remapping) are called upon address mismatch
during IPsec processing.
For that to work, we rely on the fact that SPI values generated
locally are no more linked to destination address (first patch
of the set) and we postpone a bit the expected address check in
xfrm_input() (inside xfrm_state_lookup() against daddr param) by
introducing xfrm_input_addr_check() helper.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
---
include/net/xfrm.h | 3 ++
net/ipv4/xfrm4_input.c | 12 +++++++++
net/ipv6/xfrm6_input.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++-
net/xfrm/xfrm_input.c | 25 ++++++++++++++++--
net/xfrm/xfrm_state.c | 2 +-
5 files changed, 102 insertions(+), 5 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 7ac6abe..61a0562 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -623,6 +623,7 @@ struct xfrm_spi_skb_cb {
struct inet6_skb_parm h6;
} header;
+ unsigned int saddroff;
unsigned int daddroff;
unsigned int family;
};
@@ -1405,6 +1406,7 @@ extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
int encap_type);
extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
extern int xfrm4_rcv(struct sk_buff *skb);
+extern int xfrm4_input_addr_check(struct sk_buff *skb, struct xfrm_state *x);
static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
{
@@ -1423,6 +1425,7 @@ extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
extern int xfrm6_rcv(struct sk_buff *skb);
extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
xfrm_address_t *saddr, u8 proto);
+extern int xfrm6_input_addr_check(struct sk_buff *skb, struct xfrm_state *x);
extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 06814b6..82e23ec 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -41,6 +41,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
int encap_type)
{
XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+ XFRM_SPI_SKB_CB(skb)->saddroff = offsetof(struct iphdr, saddr);
XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
return xfrm_input(skb, nexthdr, spi, encap_type);
}
@@ -164,3 +165,14 @@ int xfrm4_rcv(struct sk_buff *skb)
return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0);
}
EXPORT_SYMBOL(xfrm4_rcv);
+
+int xfrm4_input_addr_check(struct sk_buff *skb, struct xfrm_state *x)
+{
+ xfrm_address_t *daddr;
+
+ daddr = (xfrm_address_t *)(skb_network_header(skb) +
+ XFRM_SPI_SKB_CB(skb)->daddroff);
+
+ return xfrm_addr_cmp(&x->id.daddr, daddr, AF_INET);
+}
+EXPORT_SYMBOL(xfrm4_input_addr_check);
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index f8c3cf8..dda3175 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -15,6 +15,8 @@
#include <linux/netfilter_ipv6.h>
#include <net/ipv6.h>
#include <net/xfrm.h>
+#include <net/addrconf.h> /* XXX for ipv6_chk_home_addr() */
+#include <net/ip6_route.h> /* XXX for ip6_route_input() */
int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
{
@@ -24,6 +26,7 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
{
XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
+ XFRM_SPI_SKB_CB(skb)->saddroff = offsetof(struct ipv6hdr, saddr);
XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
return xfrm_input(skb, nexthdr, spi, 0);
}
@@ -142,5 +145,65 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
drop:
return -1;
}
-
EXPORT_SYMBOL(xfrm6_input_addr);
+
+/* Perform check on source and destination addresses and possibly IRO
+ * address remapping upon mismatch and if matching IRO state exists. */
+int xfrm6_input_addr_check(struct sk_buff *skb, struct xfrm_state *x)
+{
+ xfrm_address_t *saddr, *exp_saddr, *daddr, *exp_daddr;
+
+ saddr = (xfrm_address_t *)(skb_network_header(skb) +
+ XFRM_SPI_SKB_CB(skb)->saddroff);
+ daddr = (xfrm_address_t *)(skb_network_header(skb) +
+ XFRM_SPI_SKB_CB(skb)->daddroff);
+
+ exp_daddr = &x->id.daddr;
+ if (xfrm_addr_cmp(exp_daddr, daddr, AF_INET6)) {
+ /* Destination address mismatch: check if we have an IRO
+ * destination remapping state to explain that.
+ *
+ * Note: saddr is provided as a hint. If source address
+ * is also a remapped one, xfrm6_input_addr() will manage
+ * to find IRO destination remapping state */
+ if (xfrm6_input_addr(skb, exp_daddr, saddr,
+ XFRM_PROTO_IRO_DST) < 0)
+ return -1;
+
+ if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev),
+ (struct in6_addr *)exp_daddr))
+ return -1;
+
+ /* Copy destination address to sec_path for sock opts and
+ * replace packet destination address with expected HoA */
+ ipv6_addr_copy(&skb->sp->irodst, (struct in6_addr *)daddr);
+ ipv6_addr_copy((struct in6_addr *)daddr,
+ (struct in6_addr *)exp_daddr);
+
+ skb_dst_drop(skb);
+ ip6_route_input(skb);
+ if (skb_dst(skb)->error)
+ return -1;
+ }
+
+ exp_saddr = &x->props.saddr;
+ if (xfrm_addr_cmp(exp_saddr, saddr, AF_INET6)) {
+ /* Source address mismatch: check if we have an IRO
+ * source remapping state to explain that.
+ *
+ * Note: unlike for destination addresses above, a
+ * source mismatch is not considered fatal */
+ if (xfrm6_input_addr(skb, daddr, exp_saddr,
+ XFRM_PROTO_IRO_SRC) < 0)
+ return 0;
+
+ /* Copy destination address to sec_path for sock opts and
+ * then replace source address with expected peer's HoA */
+ ipv6_addr_copy(&skb->sp->irosrc, (struct in6_addr *)saddr);
+ ipv6_addr_copy((struct in6_addr *)saddr,
+ (struct in6_addr *)exp_saddr);
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL(xfrm6_input_addr_check);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 45f1c98..95e19ac 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -102,13 +102,30 @@ int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
}
EXPORT_SYMBOL(xfrm_prepare_input);
+int xfrm_input_addr_check(struct sk_buff *skb, struct xfrm_state *x,
+ unsigned int family)
+{
+ switch (family) {
+ case AF_INET:
+ if (xfrm4_input_addr_check(skb, x))
+ return -1;
+ break;
+ case AF_INET6:
+ if (xfrm6_input_addr_check(skb, x))
+ return -1;
+ break;
+ }
+
+ return 0;
+}
+
int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
{
struct net *net = dev_net(skb->dev);
int err;
__be32 seq;
struct xfrm_state *x;
- xfrm_address_t *daddr;
+ xfrm_address_t *saddr, *daddr;
struct xfrm_mode *inner_mode;
unsigned int family;
int decaps = 0;
@@ -136,6 +153,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
skb->sp = sp;
}
+ saddr = (xfrm_address_t *)(skb_network_header(skb) +
+ XFRM_SPI_SKB_CB(skb)->saddroff);
daddr = (xfrm_address_t *)(skb_network_header(skb) +
XFRM_SPI_SKB_CB(skb)->daddroff);
family = XFRM_SPI_SKB_CB(skb)->family;
@@ -152,8 +171,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
goto drop;
}
- x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
- if (x == NULL) {
+ x = xfrm_state_lookup(net, skb->mark, NULL, spi, nexthdr, family);
+ if (x == NULL || xfrm_input_addr_check(skb, x, family)) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
xfrm_audit_state_notfound(skb, family, spi, seq);
goto drop;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7ad4462..688efc1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -677,7 +677,7 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_ad
if (x->props.family != family ||
x->id.spi != spi ||
x->id.proto != proto ||
- xfrm_addr_cmp(&x->id.daddr, daddr, family))
+ (daddr && xfrm_addr_cmp(&x->id.daddr, daddr, family)))
continue;
if ((mark & x->mark.m) != x->mark.v)
--
1.7.1
^ permalink raw reply related
* [PATCH net-next-2.6 3/5] XFRM,IPv6: Add IRO src/dst address remapping XFRM types and i/o handlers
From: Arnaud Ebalard @ 2010-09-24 19:24 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
In-Reply-To: <87bp7nrlvy.fsf@small.ssi.corp>
Add IRO source and destination remapping XFRM types and associated
input/output handlers. This allows userland to install such states
in order to support remapping of source or destination address
of packet. They basically work like existing RH2 and HAO ones; the
main difference is that output handlers do not expand the packet by
adding an extension header: they simply change the source or
destination in place. Input handlers are almost the same as RH2/HAO
version in their behavior, but they are triggered differently. RH2
and HAO handlers are triggered based on structures found in the
packet. On input, IRO states (and associated handlers) are looked
up when processing an IPsec-protected packet, when there is an
address mismatch.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
---
include/net/xfrm.h | 2 +
net/ipv6/mip6.c | 140 ++++++++++++++++++++++++++++++++++++++++++++++
net/ipv6/xfrm6_mode_ro.c | 11 +++-
net/xfrm/xfrm_user.c | 2 +
4 files changed, 154 insertions(+), 1 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index f35bade..7ac6abe 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -35,6 +35,8 @@
#define XFRM_PROTO_IPV6 41
#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
+#define XFRM_PROTO_IRO_SRC 127
+#define XFRM_PROTO_IRO_DST 128
#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
#define MODULE_ALIAS_XFRM_MODE(family, encap) \
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index d6e9599..b52c651 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -477,6 +477,130 @@ static const struct xfrm_type mip6_rthdr_type =
.hdr_offset = mip6_rthdr_offset,
};
+/* IRO equivalent of mip6_destopt_input(): handles incoming packet with a
+ * source address different from the one expected in the SA: check that
+ * received source address is indeed the CoA we expected (or any address
+ * if the state references the unspecified address '::') */
+static int mip6_iro_src_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+ int err = 1;
+
+ spin_lock(&x->lock);
+ if (!ipv6_addr_equal(&iph->saddr, (struct in6_addr *)x->coaddr) &&
+ !ipv6_addr_any((struct in6_addr *)x->coaddr))
+ err = -ENOENT;
+ spin_unlock(&x->lock);
+
+ return err;
+}
+
+/* IRO equivalent of mip6_destopt_output(): replaces current source address
+ * of outgoing packet by state's CoA. */
+static int mip6_iro_src_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+
+ spin_lock_bh(&x->lock);
+ memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
+ spin_unlock_bh(&x->lock);
+
+ return 0;
+}
+
+static int mip6_iro_src_reject(struct xfrm_state *x, struct sk_buff *skb, struct flowi *fl)
+{
+ int err = 0;
+
+ /* XXX We may need some reject handler at some point but it is not
+ * critical yet: see xfrm_secpath_reject() in net/xfrm/xfrm_policy.c
+ * and aslo what mip6_destopt_reject() implements */
+
+ printk("XXX FIXME: mip6_iro_src_reject() called\n");
+
+ return err;
+}
+
+/* This is the IRO equivalent of mip6_rthdr_input(): handles incoming packet
+ * with a destination address different from the one expected in the SA:
+ * check that received destination address is indeed the CoA we expected
+ * (or any address if the state references the unspecified address '::') */
+static int mip6_iro_dst_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+ int err = 1;
+
+ spin_lock(&x->lock);
+ if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) &&
+ !ipv6_addr_any((struct in6_addr *)x->coaddr))
+ err = -ENOENT;
+ spin_unlock(&x->lock);
+
+ return err;
+}
+
+/* IRO equivalent of mip6_rthdr_output(): replaces current destination
+ * address of outgoing packet with state's CoA */
+static int mip6_iro_dst_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+
+ spin_lock_bh(&x->lock);
+ memcpy(&iph->daddr, x->coaddr, sizeof(iph->daddr));
+ spin_unlock_bh(&x->lock);
+
+ return 0;
+}
+
+/* Common to iro src and dst remapping states. */
+static int mip6_iro_init_state(struct xfrm_state *x)
+{
+ if (x->id.spi) {
+ printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
+ x->id.spi);
+ return -EINVAL;
+ }
+ if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
+ printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+ __func__, XFRM_MODE_ROUTEOPTIMIZATION,
+ x->props.mode);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+/* Unlike common IPsec protocols, nothing to do when destroying */
+static void mip6_iro_destroy(struct xfrm_state *x)
+{
+}
+
+static const struct xfrm_type mip6_iro_src_type =
+{
+ .description = "MIP6_IRO_SRC",
+ .owner = THIS_MODULE,
+ .proto = XFRM_PROTO_IRO_SRC,
+ .flags = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_LOCAL_COADDR,
+ .init_state = mip6_iro_init_state,
+ .destructor = mip6_iro_destroy,
+ .input = mip6_iro_src_input,
+ .output = mip6_iro_src_output,
+ .reject = mip6_iro_src_reject,
+};
+
+
+static const struct xfrm_type mip6_iro_dst_type =
+{
+ .description = "MIP6_IRO_DST",
+ .owner = THIS_MODULE,
+ .proto = XFRM_PROTO_IRO_DST,
+ .flags = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_REMOTE_COADDR,
+ .init_state = mip6_iro_init_state,
+ .destructor = mip6_iro_destroy,
+ .input = mip6_iro_dst_input,
+ .output = mip6_iro_dst_output,
+};
+
static int __init mip6_init(void)
{
printk(KERN_INFO "Mobile IPv6\n");
@@ -489,6 +613,14 @@ static int __init mip6_init(void)
printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __func__);
goto mip6_rthdr_xfrm_fail;
}
+ if (xfrm_register_type(&mip6_iro_src_type, AF_INET6) < 0) {
+ printk(KERN_INFO "%s: can't add xfrm type(IRO src remap)\n", __func__);
+ goto mip6_iro_src_remap_xfrm_fail;
+ }
+ if (xfrm_register_type(&mip6_iro_dst_type, AF_INET6) < 0) {
+ printk(KERN_INFO "%s: can't add xfrm type(IRO dst remap)\n", __func__);
+ goto mip6_iro_dst_remap_xfrm_fail;
+ }
if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
printk(KERN_INFO "%s: can't add rawv6 mh filter\n", __func__);
goto mip6_rawv6_mh_fail;
@@ -498,6 +630,10 @@ static int __init mip6_init(void)
return 0;
mip6_rawv6_mh_fail:
+ xfrm_unregister_type(&mip6_iro_dst_type, AF_INET6);
+ mip6_iro_dst_remap_xfrm_fail:
+ xfrm_unregister_type(&mip6_iro_src_type, AF_INET6);
+ mip6_iro_src_remap_xfrm_fail:
xfrm_unregister_type(&mip6_rthdr_type, AF_INET6);
mip6_rthdr_xfrm_fail:
xfrm_unregister_type(&mip6_destopt_type, AF_INET6);
@@ -509,6 +645,10 @@ static void __exit mip6_fini(void)
{
if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
printk(KERN_INFO "%s: can't remove rawv6 mh filter\n", __func__);
+ if (xfrm_unregister_type(&mip6_iro_dst_type, AF_INET6) < 0)
+ printk(KERN_INFO "%s: can't remove xfrm type(IRO dst remap)\n", __func__);
+ if (xfrm_unregister_type(&mip6_iro_src_type, AF_INET6) < 0)
+ printk(KERN_INFO "%s: can't remove xfrm type(IRO src remap)\n", __func__);
if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __func__);
if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 63d5d49..ea33178 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -45,6 +45,15 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
u8 *prevhdr;
int hdr_len;
+ /* Unlike RH2 (IPPROTO_ROUTING) and HAO in DstOpt
+ * (IPPROTO_DSTOPTS), IRO remapping states do not
+ * add extension header to the packet. Source
+ * and/or destination addresses are simply modified
+ * in place. */
+ if (x->id.proto == XFRM_PROTO_IRO_SRC ||
+ x->id.proto == XFRM_PROTO_IRO_DST)
+ goto out;
+
iph = ipv6_hdr(skb);
hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
@@ -54,8 +63,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
__skb_pull(skb, hdr_len);
memmove(ipv6_hdr(skb), iph, hdr_len);
+ out:
x->lastused = get_seconds();
-
return 0;
}
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8bae6b2..cc81783 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -179,6 +179,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
case IPPROTO_DSTOPTS:
case IPPROTO_ROUTING:
+ case XFRM_PROTO_IRO_SRC:
+ case XFRM_PROTO_IRO_DST:
if (attrs[XFRMA_ALG_COMP] ||
attrs[XFRMA_ALG_AUTH] ||
attrs[XFRMA_ALG_AUTH_TRUNC] ||
--
1.7.1
^ permalink raw reply related
* [PATCH net-next-2.6 2/5] XFRM,IPv6: Introduce receive sockopts to access IRO remapped src/dst addresses
From: Arnaud Ebalard @ 2010-09-24 19:22 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
In-Reply-To: <87bp7nrlvy.fsf@small.ssi.corp>
This patch introduces IRO recv sockopts, in order for userland processes
(e.g. UMIP) to access on-wire source or destination addresses found in
incoming (IPsec-protected) packets as they were before remapping by IRO.
The socket options are respectively IPV6_RECVIROSRC and IPV6_RECVIRODST.
Basically, the two recv socket options are similar in their purpose to
their generic RH2/HAO counterparts defined in RFC 3542 (IPV6_RECVIROSRC
<-> IPV6_RECVDSTOPTS, IPV6_RECVIRODST <-> IPV6_RECVRTHDR). They differ
on the following aspects:
- IRO reporting sockopts only work on incoming IPsec-protected packets
Userspace will never get IRO remapped address report for common
(non protected) packets.
- The receiver gets the original source/desination address (IRO
remapping) from its IPsec stack.
- as IRO sockopts only deal with addresses, no specific structure is
defined, i.e. struct in6_addr is used to pass info.
As we only interact with IPsec protected packets, struct sec_path is
used to carry information (addresses) for incoming packets that have
undergone remapping process.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
---
include/linux/in6.h | 7 +++++++
include/linux/ipv6.h | 4 +++-
include/net/xfrm.h | 5 +++++
net/ipv6/datagram.c | 18 ++++++++++++++++++
net/ipv6/ipv6_sockglue.c | 26 ++++++++++++++++++++++++++
5 files changed, 59 insertions(+), 1 deletions(-)
diff --git a/include/linux/in6.h b/include/linux/in6.h
index c4bf46f..52a98ab 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -283,4 +283,11 @@ struct in6_flowlabel_req {
* MRT6_PIM 208
* (reserved) 209
*/
+
+/* IRO (IPsec Route Optimization) sockopts */
+#define IPV6_RECVIROSRC 74
+#define IPV6_IROSRC 75
+#define IPV6_RECVIRODST 76
+#define IPV6_IRODST 77
+
#endif
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index e62683b..55289ee 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -341,7 +341,9 @@ struct ipv6_pinfo {
odstopts:1,
rxflow:1,
rxtclass:1,
- rxpmtu:1;
+ rxpmtu:1,
+ irosrc:1,
+ irodst:1;
} bits;
__u16 all;
} rxopt;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index fc8f36d..f35bade 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -909,6 +909,11 @@ struct sec_path {
atomic_t refcnt;
int len;
struct xfrm_state *xvec[XFRM_MAX_DEPTH];
+
+#ifdef CONFIG_XFRM_SUB_POLICY
+ struct in6_addr irosrc;
+ struct in6_addr irodst;
+#endif
};
static inline struct sec_path *
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index ef371aa..2952c9e 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -29,6 +29,7 @@
#include <net/transp_v6.h>
#include <net/ip6_route.h>
#include <net/tcp_states.h>
+#include <net/xfrm.h>
#include <linux/errqueue.h>
#include <asm/uaccess.h>
@@ -504,6 +505,23 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr);
}
+#ifdef CONFIG_XFRM_SUB_POLICY
+ /* If access to IRO-remapped source or destination address has been
+ * requested and it has indeed been remapped, provide the on-wire
+ * address to userland */
+ if (skb_sec_path(skb)) {
+ struct sec_path *sp = skb_sec_path(skb);
+
+ if (np->rxopt.bits.irosrc && !ipv6_addr_any(&sp->irosrc))
+ put_cmsg(msg, SOL_IPV6, IPV6_IROSRC,
+ sizeof(sp->irosrc), &sp->irosrc);
+
+ if (np->rxopt.bits.irodst && !ipv6_addr_any(&sp->irodst))
+ put_cmsg(msg, SOL_IPV6, IPV6_IRODST,
+ sizeof(sp->irodst), &sp->irodst);
+ }
+#endif
+
if (opt->lastopt &&
(np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) {
/*
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a7f66bc..722a49f 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -302,6 +302,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
retv = 0;
break;
+#ifdef CONFIG_XFRM_SUB_POLICY
+ case IPV6_RECVIROSRC:
+ if (optlen < sizeof(int))
+ goto e_inval;
+ np->rxopt.bits.irosrc = valbool;
+ retv = 0;
+ break;
+
+ case IPV6_RECVIRODST:
+ if (optlen < sizeof(int))
+ goto e_inval;
+ np->rxopt.bits.irodst = valbool;
+ retv = 0;
+ break;
+#endif
+
case IPV6_2292DSTOPTS:
if (optlen < sizeof(int))
goto e_inval;
@@ -1056,6 +1072,16 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
val = np->rxopt.bits.dstopts;
break;
+#ifdef CONFIG_XFRM_SUB_POLICY
+ case IPV6_RECVIROSRC:
+ val = np->rxopt.bits.irosrc;
+ break;
+
+ case IPV6_RECVIRODST:
+ val = np->rxopt.bits.irodst;
+ break;
+#endif
+
case IPV6_2292DSTOPTS:
val = np->rxopt.bits.odstopts;
break;
--
1.7.1
^ permalink raw reply related
* [PATCH net-next-2.6 1/5] XFRM,IPv6: Remove xfrm_spi_hash() dependency on destination address
From: Arnaud Ebalard @ 2010-09-24 19:21 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
In-Reply-To: <87bp7nrlvy.fsf@small.ssi.corp>
In the new IPsec architecture [RFC4301], "for an SA used to carry
unicast traffic, the Security Parameters Index (SPI) by itself
suffices to specify an SA". Section 4.1 of [RFC4301] provides
additional guidance on the topic.
In the old IPsec architecture [RFC2401], a SA "is uniquely identified
by a triple consisting of a Security Parameter Index (SPI), an IP
Destination Address and a security protocol (AH or ESP) identifier".
If an IPsec stack only supports the behavior mandated by the old
IPsec architecture, SAD lookup on inbound packets require the use of
both the SPI and the destination address of the SA.
For inbound IPsec traffic, IRO remapping rules may exist on the MN to
remap the destination address (CoA) into the HoA. In that case, by
design, the address found in the destination address field of the
packet (CoA) does not match the one in the SA (HoA).
At the moment, Linux XFRM stack includes the address when computing
the hash to perform state lookup by SPI. This patch changes XFRM
state hash computation to prevent destination address to be
used. This will later allow finding states for packets w/ mangled
destination addresses.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
---
net/xfrm/xfrm_hash.h | 21 +--------------------
net/xfrm/xfrm_state.c | 20 ++++++++------------
2 files changed, 9 insertions(+), 32 deletions(-)
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index 8e69533..19eeee7 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -4,16 +4,6 @@
#include <linux/xfrm.h>
#include <linux/socket.h>
-static inline unsigned int __xfrm4_addr_hash(xfrm_address_t *addr)
-{
- return ntohl(addr->a4);
-}
-
-static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
-{
- return ntohl(addr->a6[2] ^ addr->a6[3]);
-}
-
static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
{
u32 sum = (__force u32)daddr->a4 + (__force u32)saddr->a4;
@@ -60,18 +50,9 @@ static inline unsigned __xfrm_src_hash(xfrm_address_t *daddr,
}
static inline unsigned int
-__xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family,
- unsigned int hmask)
+__xfrm_spi_hash(__be32 spi, u8 proto, unsigned int hmask)
{
unsigned int h = (__force u32)spi ^ proto;
- switch (family) {
- case AF_INET:
- h ^= __xfrm4_addr_hash(daddr);
- break;
- case AF_INET6:
- h ^= __xfrm6_addr_hash(daddr);
- break;
- }
return (h ^ (h >> 10) ^ (h >> 20)) & hmask;
}
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5208b12..7ad4462 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -30,7 +30,7 @@
/* Each xfrm_state may be linked to two tables:
- 1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
+ 1. Hash table by (spi,ah/esp) to find SA by SPI. (input,ctl)
2. Hash table by (daddr,family,reqid) to find what SAs exist for given
destination/tunnel endpoint. (output)
*/
@@ -67,9 +67,9 @@ static inline unsigned int xfrm_src_hash(struct net *net,
}
static inline unsigned int
-xfrm_spi_hash(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
+xfrm_spi_hash(struct net *net, __be32 spi, u8 proto)
{
- return __xfrm_spi_hash(daddr, spi, proto, family, net->xfrm.state_hmask);
+ return __xfrm_spi_hash(spi, proto, net->xfrm.state_hmask);
}
static void xfrm_hash_transfer(struct hlist_head *list,
@@ -95,9 +95,7 @@ static void xfrm_hash_transfer(struct hlist_head *list,
hlist_add_head(&x->bysrc, nsrctable+h);
if (x->id.spi) {
- h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
- x->id.proto, x->props.family,
- nhashmask);
+ h = __xfrm_spi_hash(x->id.spi, x->id.proto, nhashmask);
hlist_add_head(&x->byspi, nspitable+h);
}
}
@@ -671,7 +669,7 @@ xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
{
- unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
+ unsigned int h = xfrm_spi_hash(net, spi, proto);
struct xfrm_state *x;
struct hlist_node *entry;
@@ -859,7 +857,7 @@ found:
h = xfrm_src_hash(net, daddr, saddr, family);
hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
if (x->id.spi) {
- h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family);
+ h = xfrm_spi_hash(net, x->id.spi, x->id.proto);
hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
}
x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
@@ -933,9 +931,7 @@ static void __xfrm_state_insert(struct xfrm_state *x)
hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
if (x->id.spi) {
- h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
- x->props.family);
-
+ h = xfrm_spi_hash(net, x->id.spi, x->id.proto);
hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
}
@@ -1526,7 +1522,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
}
if (x->id.spi) {
spin_lock_bh(&xfrm_state_lock);
- h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
+ h = xfrm_spi_hash(net, x->id.spi, x->id.proto);
hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
spin_unlock_bh(&xfrm_state_lock);
--
1.7.1
^ permalink raw reply related
* [PATCH net-next-2.6 0/5] XFRM,IPv6: Removal of RH2/HAO from IPsec-protected MIPv6 traffic
From: Arnaud Ebalard @ 2010-09-24 19:18 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Herbert Xu, Hideaki YOSHIFUJI; +Cc: netdev
Hi,
First off, patches for discussion are in following emails. They are
*against current linux-2.6* (on which they were tested) but will be
rebased against net-next-2.6 for next round.
Simply put, the patches provides the ability to remove annoying Routing
Header Type 2 and Destination Options Header with Home Address Option
from IPsec-protected MIPv6 signaling traffic, changing on-wire format
from:
MN ------------ IPv6() / HAO / ESP(BU) ----------> HA
MN <----------- IPv6() / RH2 / ESP(BA) ----------- HA
to
MN ------------ IPv6() / ESP(BU) --------------> HA
MN <----------- IPv6() / ESP(BA) --------------- HA
This is an *self-contained* part of a set of additional enhancements for
Mobile IPv6 when used w/ IPsec and IKE specified in IRO draft [1]. Once
available, this can also be extended to IPsec-protected route optimized
communications between MN and CN/MN.
Among the operational benefits of the feature is the ability to run in
networks in which (dumb) firewalls drop Routing Headers (Cisco PIX
firewalls are known to do that by default and w/o ways of correcting the
issue). Anonimity is another.
Basically, RH2/HAO are only *explicit* containers for the Home Address
(HoA), which is obviously available in the IPsec stack (transport mode
SA protecting traffic use the HoA). This means that the info is
available on both sides and there is no real need to carry it explictly.
>From an implementation standpoint, some changes are required to allow
finding the SA when the addresses are not expected ones and remap them
if asked to do so (or act as usual if not). Then, most of the other
changes are basically simple versions of what can be found at the moment
for RH2 and HAO in DestOpt handling. Unlike what happens with RH2/HAO,
packets structure is never modified.
I rely on the feature on my MN (my laptop) and HA for 2 kernel versions
to provide me with connectivity (v4 networks are handled using
m6t [1]). Patches for UMIP [2] are available and will be merged upstream
if the feature gets accepted. At the moment, the people using the Debian
package for UMIP [3] can simply benefit from the feature by compiling a
patched kernel (2.6.34 and 2.6.35.5 available [5]), and then doing a
simple apt-get remove umip && apt-get install umip-iro.
Cheers,
a+
[1] http://tools.ietf.org/html/draft-ebalard-mext-ipsec-ro
[2] http://natisbad.org/m6t/
[3] http://umip.org/
[4] http://umip.org/docs/umip-debrepo.html
[5] http://natisbad.org/IRO/
^ permalink raw reply
* [PATCH 15/24] net: change to new flag variable
From: matt mooney @ 2010-09-24 19:17 UTC (permalink / raw)
To: kernel-janitors-u79uwXL29TY76Z2rM5mHXA
Cc: Sjur Braendeland, Jouni Malinen, John W. Linville, Daniel Drake,
Ulrich Kunitz, netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-wireless-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <e0bdab5d2e8c52041c003de68ba774c3e706716c.1285355033.git.mfm-Oo0r1OC9pj9iLUuM0BA3LQ@public.gmane.org>
Replace EXTRA_CFLAGS with ccflags-y.
Signed-off-by: matt mooney <mfm-Oo0r1OC9pj9iLUuM0BA3LQ@public.gmane.org>
---
drivers/net/caif/Makefile | 4 +---
drivers/net/skfp/Makefile | 2 +-
drivers/net/wan/lmc/Makefile | 2 +-
drivers/net/wireless/hostap/hostap_config.h | 4 ++--
drivers/net/wireless/zd1211rw/Makefile | 4 +---
5 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/net/caif/Makefile b/drivers/net/caif/Makefile
index 3a11d61..b5dc44c 100644
--- a/drivers/net/caif/Makefile
+++ b/drivers/net/caif/Makefile
@@ -1,6 +1,4 @@
-ifeq ($(CONFIG_CAIF_DEBUG),y)
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_CAIF_DEBUG) := -DDEBUG
# Serial interface
obj-$(CONFIG_CAIF_TTY) += caif_serial.o
diff --git a/drivers/net/skfp/Makefile b/drivers/net/skfp/Makefile
index cb23580..045d815 100644
--- a/drivers/net/skfp/Makefile
+++ b/drivers/net/skfp/Makefile
@@ -17,4 +17,4 @@ skfp-objs := skfddi.o hwmtm.o fplustm.o smt.o cfm.o \
# projects. To keep the source common for all those drivers (and
# thus simplify fixes to it), please do not clean it up!
-EXTRA_CFLAGS += -Idrivers/net/skfp -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
+ccflags-y := -Idrivers/net/skfp -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
diff --git a/drivers/net/wan/lmc/Makefile b/drivers/net/wan/lmc/Makefile
index dabdcfe..609710d 100644
--- a/drivers/net/wan/lmc/Makefile
+++ b/drivers/net/wan/lmc/Makefile
@@ -14,4 +14,4 @@ lmc-objs := lmc_debug.o lmc_media.o lmc_main.o lmc_proto.o
# -DDEBUG \
# -DLMC_PACKET_LOG
-EXTRA_CFLAGS += -I. $(DBGDEF)
+ccflags-y := -I. $(DBGDEF)
diff --git a/drivers/net/wireless/hostap/hostap_config.h b/drivers/net/wireless/hostap/hostap_config.h
index 30acd39..2c8f71f 100644
--- a/drivers/net/wireless/hostap/hostap_config.h
+++ b/drivers/net/wireless/hostap/hostap_config.h
@@ -30,9 +30,9 @@
/* Following defines can be used to remove unneeded parts of the driver, e.g.,
* to limit the size of the kernel module. Definitions can be added here in
- * hostap_config.h or they can be added to make command with EXTRA_CFLAGS,
+ * hostap_config.h or they can be added to make command with ccflags-y,
* e.g.,
- * 'make pccard EXTRA_CFLAGS="-DPRISM2_NO_DEBUG -DPRISM2_NO_PROCFS_DEBUG"'
+ * 'make pccard ccflags-y="-DPRISM2_NO_DEBUG -DPRISM2_NO_PROCFS_DEBUG"'
*/
/* Do not include debug messages into the driver */
diff --git a/drivers/net/wireless/zd1211rw/Makefile b/drivers/net/wireless/zd1211rw/Makefile
index 1907eaf..5728a91 100644
--- a/drivers/net/wireless/zd1211rw/Makefile
+++ b/drivers/net/wireless/zd1211rw/Makefile
@@ -5,7 +5,5 @@ zd1211rw-objs := zd_chip.o zd_mac.o \
zd_rf_al7230b.o zd_rf_uw2453.o \
zd_rf.o zd_usb.o
-ifeq ($(CONFIG_ZD1211RW_DEBUG),y)
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_ZD1211RW_DEBUG) := -DDEBUG
--
1.7.2.1
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* [PATCH 10/24] isdn: change to new flag variable
From: matt mooney @ 2010-09-24 19:17 UTC (permalink / raw)
To: kernel-janitors; +Cc: Karsten Keil, netdev, linux-kernel
In-Reply-To: <e0bdab5d2e8c52041c003de68ba774c3e706716c.1285355033.git.mfm@muteddisk.com>
Replace EXTRA_CFLAGS with ccflags-y.
Signed-off-by: matt mooney <mfm@muteddisk.com>
---
drivers/isdn/hisax/Makefile | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/isdn/hisax/Makefile b/drivers/isdn/hisax/Makefile
index ab638b08..646368f 100644
--- a/drivers/isdn/hisax/Makefile
+++ b/drivers/isdn/hisax/Makefile
@@ -4,7 +4,7 @@
# Define maximum number of cards
-EXTRA_CFLAGS += -DHISAX_MAX_CARDS=$(CONFIG_HISAX_MAX_CARDS)
+ccflags-y := -DHISAX_MAX_CARDS=$(CONFIG_HISAX_MAX_CARDS)
obj-$(CONFIG_ISDN_DRV_HISAX) += hisax.o
obj-$(CONFIG_HISAX_SEDLBAUER_CS) += sedlbauer_cs.o
--
1.7.2.1
^ permalink raw reply related
* Re: [PATCH net-next-2.6 0/5] XFRM,IPv6: Removal of RH2/HAO from IPsec-protected MIPv6 traffic
From: David Miller @ 2010-09-24 19:01 UTC (permalink / raw)
To: arno; +Cc: eric.dumazet, herbert, yoshfuji, netdev
In-Reply-To: <87ocbnxa0i.fsf@small.ssi.corp>
From: arno@natisbad.org (Arnaud Ebalard)
Date: Fri, 24 Sep 2010 20:38:05 +0200
> Hi,
>
> [This is a resend: after 6 hours, nothing appeared on the list. Sorry
> if you received it twice]
They didn't appear on the list because your email header fields
are all screwed up, I forwarded the bounce messages to you twice
under seperate cover.
^ permalink raw reply
* Re: [PATCH 2/5] AF_UNIX: enable/disable multicast with getsockopt/setsockopt
From: Eric Dumazet @ 2010-09-24 18:02 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel
In-Reply-To: <1285350388.2478.0.camel@edumazet-laptop>
Le vendredi 24 septembre 2010 à 19:46 +0200, Eric Dumazet a écrit :
Hmm
dbus-owner@lists.freedesktop.org is a subscriber only list ....
Please dont use it
^ permalink raw reply
* Re: [PATCH 4/5] AF_UNIX: find peers on multicast Unix stream sockets
From: Eric Dumazet @ 2010-09-24 18:00 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus
In-Reply-To: <1285349116-17529-4-git-send-email-alban.crequy@collabora.co.uk>
Le vendredi 24 septembre 2010 à 18:25 +0100, Alban Crequy a écrit :
> @@ -1612,7 +1671,12 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
> } else {
> sunaddr = NULL;
> err = -ENOTCONN;
> - other = NULL; /* FIXME: get the list of other connection */
> + max_others = atomic_read(&unix_nr_multicast_socks);
> + others = kzalloc((max_others + 1) * sizeof(void *), GFP_KERNEL);
> + unix_find_other(sock_net(sk), u->addr->name,
> + u->addr->len, 0, u->addr->hash, 1, others, max_others, &err);
> + other = others[0];
> + kfree(others);
> if (!other)
> goto out_err;
> }
Seriously, this block sizing against unix_nr_multicast_socks is not
scalable. What happens if we have 1000 sockets ?
kzalloc() to clear 8000 bytes ?
Its also unsafe.
(say you kzalloc() a buffer for 2 sockets, and another cpu inserts a new
socket. unix_find_socket_byname() can overflow the buffer)
You should use a list, and allocates elements in
unix_find_socket_byname()
struct item {
struct item *next;
struct sock *s;
};
^ permalink raw reply
* Re: [PATCH 1/8] posix clocks: introduce a syscall for clock tuning.
From: john stultz @ 2010-09-24 17:55 UTC (permalink / raw)
To: Richard Cochran
Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA,
devicetree-discuss-uLR06cmDAlY/bJ5BZ2RsiQ,
linux-api-u79uwXL29TY76Z2rM5mHXA,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linuxppc-dev-uLR06cmDAlY/bJ5BZ2RsiQ,
netdev-u79uwXL29TY76Z2rM5mHXA, Arnd Bergmann, Christoph Lameter,
David Miller, Krzysztof Halasa, Peter Zijlstra, Rodolfo Giometti,
Thomas Gleixner
In-Reply-To: <20100924072946.GA5043-7KxsofuKt4IfAd9E5cN8NEzG7cXyKsk/@public.gmane.org>
On Fri, 2010-09-24 at 09:29 +0200, Richard Cochran wrote:
> On Thu, Sep 23, 2010 at 12:48:51PM -0700, john stultz wrote:
> > So I'd still split this patch up a little bit more.
> >
> > 1) Patch that implements the ADJ_SETOFFSET (*and its implementation*)
> > in do_adjtimex.
> >
> > 2) Patch that adds the new syscall and clock_id multiplexing.
> >
> > 3) Patches that wire it up to the rest of the architectures (there's
> > still a bunch missing here).
>
> I was not sure what the policy is about adding syscalls. Is it the
> syscall author's responsibility to add it into every arch?
>
> The last time (see a2e2725541fad7) the commit only added half of some
> archs, and ignored others. In my patch, the syscall *really* works on
> the archs that are present in the patch.
>
> (Actually, I did not test blackfin, since I don't have one, but I
> included it since I know they have a PTP hardware clock.)
I'm not sure about policy, but I think for completeness sake you should
make sure every arch supports a new syscall. You're not expected to be
able to test every one, but getting the basic support patch sent to
maintainers should be done.
> > > +static inline int common_clock_adj(const clockid_t which_clock, struct timex *t)
> > > +{
> > > + if (CLOCK_REALTIME == which_clock)
> > > + return do_adjtimex(t);
> > > + else
> > > + return -EOPNOTSUPP;
> > > +}
> >
> >
> > Would it make sense to point to the do_adjtimex() in the k_clock
> > definition for CLOCK_REALTIME rather then conditionalizing it here?
>
> But what about CLOCK_MONOTONIC_RAW, for example?
-EOPNOTSUPP
> Does it make sense to allow it to be adjusted?
No. I think only CLOCK_REALTIME would make sense of the existing clocks.
I'm just suggesting you conditionalize it from the function pointer,
rather then in the common function.
thanks
-john
^ permalink raw reply
* Re: [PATCH 2/5] AF_UNIX: enable/disable multicast with getsockopt/setsockopt
From: Eric Dumazet @ 2010-09-24 17:46 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus
In-Reply-To: <1285349116-17529-2-git-send-email-alban.crequy@collabora.co.uk>
Le vendredi 24 septembre 2010 à 18:25 +0100, Alban Crequy a écrit :
> Multicast can be enabled or disabled after a socket is allocated but this
> cannot be changed once the socket is bound or connected.
>
> Userspace applications can enable multicast on an Unix stream socket:
> sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
> #define UNIX_MULTICAST 1
> val = 1;
> len = sizeof(val);
> ret = setsockopt(sockfd, 0, UNIX_MULTICAST, &val, len);
>
> Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
> + if (val != 0) {
> + u->multicast = 1;
> + } else {
> + u->multicast = 0;
> + }
u->multicast = !!val;
^ permalink raw reply
* [PATCH 4/5] AF_UNIX: find peers on multicast Unix stream sockets
From: Alban Crequy @ 2010-09-24 17:25 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Eric Dumazet, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus, Alban Crequy
In-Reply-To: <20100924182257.11abd9a6@chocolatine.cbg.collabora.co.uk>
Multicast sockets are stored in the hash table unix_multicast_socket_table.
unix_find_socket_byname() is extended to return an array of sockets matching
the name instead of only one socket. Then unix_stream_sendmsg() can find all
the multicast peers.
Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
---
net/unix/af_unix.c | 134 ++++++++++++++++++++++++++++++++++++++--------------
1 files changed, 99 insertions(+), 35 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index a8d9de7..f259849 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -115,11 +115,13 @@
#include <net/checksum.h>
#include <linux/security.h>
-static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
+static struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE + 1];
static DEFINE_SPINLOCK(unix_table_lock);
static atomic_t unix_nr_socks = ATOMIC_INIT(0);
+static atomic_t unix_nr_multicast_socks = ATOMIC_INIT(0);
-#define unix_sockets_unbound (&unix_socket_table[UNIX_HASH_SIZE])
+#define unix_multicast_socket_table (&unix_socket_table[UNIX_HASH_SIZE])
+#define unix_sockets_unbound (&unix_socket_table[2 * UNIX_HASH_SIZE])
#define UNIX_ABSTRACT(sk) (unix_sk(sk)->addr->hash != UNIX_HASH_SIZE)
@@ -227,7 +229,6 @@ static void __unix_remove_socket(struct sock *sk)
static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
{
- WARN_ON(!sk_unhashed(sk));
sk_add_node(sk, list);
}
@@ -247,12 +248,14 @@ static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk)
static struct sock *__unix_find_socket_byname(struct net *net,
struct sockaddr_un *sunname,
- int len, int type, unsigned hash)
+ int len, int type,
+ unsigned hash, int multicast)
{
struct sock *s;
struct hlist_node *node;
+ unsigned int index = (multicast ? UNIX_HASH_SIZE : 0) + (hash ^ type);
- sk_for_each(s, node, &unix_socket_table[hash ^ type]) {
+ sk_for_each(s, node, &unix_socket_table[index]) {
struct unix_sock *u = unix_sk(s);
if (!net_eq(sock_net(s), net))
@@ -267,29 +270,50 @@ found:
return s;
}
-static inline struct sock *unix_find_socket_byname(struct net *net,
- struct sockaddr_un *sunname,
- int len, int type,
- unsigned hash)
+static inline void unix_find_socket_byname(struct net *net,
+ struct sockaddr_un *sunname,
+ int len, int type,
+ unsigned hash,
+ int multicast,
+ struct sock **others, int max_others)
{
struct sock *s;
+ struct hlist_node *node;
+ int i = 0;
+ unsigned int index = (multicast ? UNIX_HASH_SIZE : 0) + (hash ^ type);
spin_lock(&unix_table_lock);
- s = __unix_find_socket_byname(net, sunname, len, type, hash);
- if (s)
- sock_hold(s);
+
+ sk_for_each(s, node, &unix_socket_table[index]) {
+ struct unix_sock *u = unix_sk(s);
+
+ if (!net_eq(sock_net(s), net))
+ continue;
+
+ if (u->addr->len == len &&
+ !memcmp(u->addr->name, sunname, len)) {
+
+ others[i++] = s;
+ sock_hold(s);
+ if (i == max_others)
+ break;
+ }
+ }
+
spin_unlock(&unix_table_lock);
- return s;
}
-static struct sock *unix_find_socket_byinode(struct net *net, struct inode *i)
+static struct sock *unix_find_socket_byinode(struct net *net, struct inode *i,
+ int multicast)
{
struct sock *s;
struct hlist_node *node;
+ unsigned int index = (multicast ? UNIX_HASH_SIZE : 0)
+ + (i->i_ino & (UNIX_HASH_SIZE - 1));
spin_lock(&unix_table_lock);
sk_for_each(s, node,
- &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
+ &unix_socket_table[index]) {
struct dentry *dentry = unix_sk(s)->dentry;
if (!net_eq(sock_net(s), net))
@@ -363,6 +387,9 @@ static void unix_sock_destructor(struct sock *sk)
if (u->addr)
unix_release_addr(u->addr);
+ if (u->multicast)
+ atomic_dec(&unix_nr_multicast_socks);
+
atomic_dec(&unix_nr_socks);
local_bh_disable();
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
@@ -700,7 +727,7 @@ retry:
ordernum = (ordernum+1)&0xFFFFF;
if (__unix_find_socket_byname(net, addr->name, addr->len, sock->type,
- addr->hash)) {
+ addr->hash, 0)) {
spin_unlock(&unix_table_lock);
/* Sanity yield. It is unusual case, but yet... */
if (!(ordernum&0xFF))
@@ -719,9 +746,11 @@ out: mutex_unlock(&u->readlock);
return err;
}
-static struct sock *unix_find_other(struct net *net,
- struct sockaddr_un *sunname, int len,
- int type, unsigned hash, int *error)
+static void unix_find_other(struct net *net,
+ struct sockaddr_un *sunname, int len,
+ int type, unsigned hash, int multicast,
+ struct sock **others, int max_others,
+ int *error)
{
struct sock *u;
struct path path;
@@ -740,7 +769,7 @@ static struct sock *unix_find_other(struct net *net,
err = -ECONNREFUSED;
if (!S_ISSOCK(inode->i_mode))
goto put_fail;
- u = unix_find_socket_byinode(net, inode);
+ u = unix_find_socket_byinode(net, inode, multicast);
if (!u)
goto put_fail;
@@ -754,24 +783,26 @@ static struct sock *unix_find_other(struct net *net,
sock_put(u);
goto fail;
}
+ others[0] = u;
} else {
+ int i;
err = -ECONNREFUSED;
- u = unix_find_socket_byname(net, sunname, len, type, hash);
- if (u) {
+ unix_find_socket_byname(net, sunname, len, type, hash,
+ multicast, others, max_others);
+ for(i = 0 ; i < max_others && others[i] != NULL ; i++) {
struct dentry *dentry;
- dentry = unix_sk(u)->dentry;
+ dentry = unix_sk(others[i])->dentry;
if (dentry)
- touch_atime(unix_sk(u)->mnt, dentry);
- } else
- goto fail;
+ touch_atime(unix_sk(others[i])->mnt, dentry);
+ }
}
- return u;
+ return;
put_fail:
path_put(&path);
fail:
*error = err;
- return NULL;
+ return;
}
@@ -862,7 +893,7 @@ out_mknod_drop_write:
if (!sunaddr->sun_path[0]) {
err = -EADDRINUSE;
if (__unix_find_socket_byname(net, sunaddr, addr_len,
- sk->sk_type, hash)) {
+ sk->sk_type, hash, 0)) {
unix_release_addr(addr);
goto out_unlock;
}
@@ -929,7 +960,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
struct sock *sk = sock->sk;
struct net *net = sock_net(sk);
struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
- struct sock *other;
+ struct sock *other = NULL;
unsigned hash;
int err;
@@ -944,7 +975,8 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
goto out;
restart:
- other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
+ unix_find_other(net, sunaddr, alen, sock->type, hash,
+ 0, &other, 1, &err);
if (!other)
goto out;
@@ -1063,7 +1095,8 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
restart:
/* Find listening sock. */
- other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, &err);
+ unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, 0, &other,
+ 1, &err);
if (!other && !u->multicast)
goto out;
@@ -1075,6 +1108,26 @@ restart:
if (u->multicast) {
sock->state = SS_CONNECTED;
sk->sk_state = TCP_ESTABLISHED;
+
+ unix_find_other(net, sunaddr, addr_len, sk->sk_type,
+ hash, 1, &other, 1, &err);
+ if (other) {
+ otheru = unix_sk(other);
+ atomic_inc(&otheru->addr->refcnt);
+ u->addr = otheru->addr;
+ } else {
+ err = -ENOMEM;
+ u->addr = kmalloc(sizeof(*u->addr)+addr_len, GFP_KERNEL);
+ if (!u->addr)
+ return err;
+
+ memcpy(u->addr->name, sunaddr, addr_len);
+ u->addr->len = addr_len;
+ u->addr->hash = hash ^ sk->sk_type;
+ atomic_set(&u->addr->refcnt, 1);
+ }
+
+ unix_insert_socket(&unix_multicast_socket_table[u->addr->hash], sk);
return 0;
}
@@ -1427,8 +1480,8 @@ restart:
if (sunaddr == NULL)
goto out_free;
- other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
- hash, &err);
+ unix_find_other(net, sunaddr, namelen, sk->sk_type,
+ hash, 0, &other, 1, &err);
if (other == NULL)
goto out_free;
}
@@ -1530,8 +1583,12 @@ static int unix_stream_setsockopt(struct socket *sock, int level, int optname,
return -EINVAL;
if (val != 0) {
+ if (!u->multicast)
+ atomic_inc(&unix_nr_multicast_socks);
u->multicast = 1;
} else {
+ if (u->multicast)
+ atomic_dec(&unix_nr_multicast_socks);
u->multicast = 0;
}
break;
@@ -1582,6 +1639,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
struct sock *sk = sock->sk;
struct sock *other = NULL;
+ struct sock **others = NULL;
+ int max_others;
struct sockaddr_un *sunaddr = msg->msg_name;
int err, size;
struct sk_buff *skb;
@@ -1612,7 +1671,12 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
} else {
sunaddr = NULL;
err = -ENOTCONN;
- other = NULL; /* FIXME: get the list of other connection */
+ max_others = atomic_read(&unix_nr_multicast_socks);
+ others = kzalloc((max_others + 1) * sizeof(void *), GFP_KERNEL);
+ unix_find_other(sock_net(sk), u->addr->name,
+ u->addr->len, 0, u->addr->hash, 1, others, max_others, &err);
+ other = others[0];
+ kfree(others);
if (!other)
goto out_err;
}
--
1.7.1
^ permalink raw reply related
* [PATCH 0/5] RFC: Multicast and filtering features on AF_UNIX
From: Alban Crequy @ 2010-09-24 17:22 UTC (permalink / raw)
To: Alban Crequy, David S. Miller, Eric Dumazet, Stephen Hemminger,
Cyrill
Hi,
I am working on improving the performances of D-Bus [1]. dbus-daemon is
connected to the peers with Unix sockets and delivers D-Bus messages
according to match rules set by the peers themselves. Every D-Bus
message goes through dbus-daemon. The number of recipients if often 1
but it can be 0, 1, or more. With this architecture, dbus-daemon has to
wake up for every message on the bus and the context switches are
expensive.
/--------\ unix socket /-------------\ unix socket /-----------\
| sender |------------->| dbus-daemon |------------->| recipient |
\--------/ AF_UNIX \-------------/ AF_UNIX \-----------/
Ian and I wrote a kernel module "dbus" to improve the performances (the
sources are not attached to this email but available there: [2]). This
is a proof-of-concept. It implements a new address family AF_DBUS,
similar to AF_UNIX, but the kernel is smart enough to deliver the
messages directly to the correct recipients, bypassing dbus-daemon. The
only change in userspace is to use AF_DBUS instead of AF_UNIX. I
compared the performances here [2]. It is about 5000 lines of code (a
big part is duplicated from net/unix/af_unix.c).
Another possibility is to add the needed features directly in AF_UNIX
sockets (and avoid to create a new address family for D-Bus):
- multicast
- some kind of BSD socket filters?
- untables?
And hopefully the new features would be useful for other userspace
applications in addition to D-Bus. Wireshark could read and display
AF_UNIX packets.
I am looking for feedback on what is the best way to do this.
The following patches implements multicast on stream Unix socket.
Applications have to enable multicast on the socket with setsockopt()
and then every packets will be delivered to all sockets connected to
the multicast address. The patches are also available on [3].
[1] http://www.freedesktop.org/wiki/Software/dbus
[2] http://alban.apinc.org/blog/2010/09/15/d-bus-in-the-kernel-faster/
[3]
http://git.collabora.co.uk/?p=user/alban/linux-2.6.35.y/.git;a=shortlog;h=refs/heads/unix-multicast
--
Alban Crequy
^ permalink raw reply
* [PATCH 1/5] AF_UNIX: add getsockopt and setsockopt on stream sockets
From: Alban Crequy @ 2010-09-24 17:25 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Eric Dumazet, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus, Alban Crequy
In-Reply-To: <20100924182257.11abd9a6@chocolatine.cbg.collabora.co.uk>
Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
---
net/unix/af_unix.c | 21 +++++++++++++++++++--
1 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fef2cc5..47d9f77 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -492,6 +492,10 @@ static unsigned int unix_dgram_poll(struct file *, struct socket *,
poll_table *);
static int unix_ioctl(struct socket *, unsigned int, unsigned long);
static int unix_shutdown(struct socket *, int);
+static int unix_stream_setsockopt(struct socket *, int, int,
+ char __user *, unsigned int);
+static int unix_stream_getsockopt(struct socket *, int, int,
+ char __user *, int __user *);
static int unix_stream_sendmsg(struct kiocb *, struct socket *,
struct msghdr *, size_t);
static int unix_stream_recvmsg(struct kiocb *, struct socket *,
@@ -518,8 +522,8 @@ static const struct proto_ops unix_stream_ops = {
.ioctl = unix_ioctl,
.listen = unix_listen,
.shutdown = unix_shutdown,
- .setsockopt = sock_no_setsockopt,
- .getsockopt = sock_no_getsockopt,
+ .setsockopt = unix_stream_setsockopt,
+ .getsockopt = unix_stream_getsockopt,
.sendmsg = unix_stream_sendmsg,
.recvmsg = unix_stream_recvmsg,
.mmap = sock_no_mmap,
@@ -1494,6 +1498,19 @@ out:
}
+static int unix_stream_setsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, unsigned int optlen)
+{
+ return -EOPNOTSUPP;
+}
+
+int unix_stream_getsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, int __user *optlen)
+{
+ return -EOPNOTSUPP;
+}
+
+
static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
struct msghdr *msg, size_t len)
{
--
1.7.1
^ permalink raw reply related
* [PATCH 5/5] AF_UNIX: deliver the data to all the multicast peers
From: Alban Crequy @ 2010-09-24 17:25 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Eric Dumazet, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus, Alban Crequy
In-Reply-To: <20100924182257.11abd9a6@chocolatine.cbg.collabora.co.uk>
With multicast sockets, unix_stream_sendmsg() needs to deliver the data to
zero, one or several recipients. skb_clone() is used to get as many sk_buff as
recipients.
If a multicast peer is too slow to receive the packets, it will block the
sender at some point in sock_alloc_send_skb().
A sender can receive SIGPIPE caused by an unique peer on the multicast group.
This is probably not what we want.
I tested this with a few peers and either sending data, receiving data or just
sleeping.
Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
---
net/unix/af_unix.c | 77 +++++++++++++++++++++++++++++++++++----------------
1 files changed, 53 insertions(+), 24 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f259849..01cb603 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1640,10 +1640,10 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
struct sock *sk = sock->sk;
struct sock *other = NULL;
struct sock **others = NULL;
+ struct sock **others_cur = NULL;
int max_others;
struct sockaddr_un *sunaddr = msg->msg_name;
int err, size;
- struct sk_buff *skb;
int sent = 0;
struct scm_cookie tmp_scm;
bool fds_sent = false;
@@ -1668,15 +1668,22 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
other = unix_peer(sk);
if (!other)
goto out_err;
+ err = -ENOMEM;
+ others = kzalloc(2 * sizeof(void *), GFP_KERNEL);
+ if (!others)
+ goto out_err;
+ others[0] = other;
} else {
sunaddr = NULL;
- err = -ENOTCONN;
max_others = atomic_read(&unix_nr_multicast_socks);
+ err = -ENOMEM;
others = kzalloc((max_others + 1) * sizeof(void *), GFP_KERNEL);
+ if (!others)
+ goto out_err;
unix_find_other(sock_net(sk), u->addr->name,
u->addr->len, 0, u->addr->hash, 1, others, max_others, &err);
+ err = -ENOTCONN;
other = others[0];
- kfree(others);
if (!other)
goto out_err;
}
@@ -1685,6 +1692,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
goto pipe_err;
while (sent < len) {
+ struct sk_buff *skb;
+ struct sk_buff *skb_cloned;
/*
* Optimisation for the fact that under 0.01% of X
* messages typically need breaking up.
@@ -1718,43 +1727,61 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
*/
size = min_t(int, size, skb_tailroom(skb));
- memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
- /* Only send the fds in the first buffer */
- if (siocb->scm->fp && !fds_sent) {
- err = unix_attach_fds(siocb->scm, skb);
- if (err) {
- kfree_skb(skb);
- goto out_err;
- }
- fds_sent = true;
- }
-
err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
if (err) {
kfree_skb(skb);
goto out_err;
}
- unix_state_lock(other);
+ others_cur = others;
+ while (*others_cur != NULL) {
+ skb_cloned = skb_clone(skb, GFP_KERNEL);
+ if (!skb_cloned) {
+ kfree_skb(skb);
+ goto out_err;
+ }
+ skb_set_owner_w(skb_cloned, sk);
+
+ memcpy(UNIXCREDS(skb_cloned), &siocb->scm->creds, sizeof(struct ucred));
+ /* Only send the fds in the first buffer of each
+ * recipient */
+ if (siocb->scm->fp && !fds_sent) {
+ err = unix_attach_fds(siocb->scm, skb_cloned);
+ if (err) {
+ kfree_skb(skb);
+ kfree_skb(skb_cloned);
+ goto out_err;
+ }
+ }
+
+ unix_state_lock(*others_cur);
- if (sock_flag(other, SOCK_DEAD) ||
- (other->sk_shutdown & RCV_SHUTDOWN))
- goto pipe_err_free;
+ if (sock_flag(*others_cur, SOCK_DEAD) ||
+ ((*others_cur)->sk_shutdown & RCV_SHUTDOWN)) {
+ unix_state_unlock(*others_cur);
+ kfree_skb(skb);
+ kfree_skb(skb_cloned);
+ goto pipe_err;
+ }
- skb_queue_tail(&other->sk_receive_queue, skb);
- unix_state_unlock(other);
- other->sk_data_ready(other, size);
+ skb_queue_tail(&(*others_cur)->sk_receive_queue,
+ skb_cloned);
+ unix_state_unlock(*others_cur);
+ (*others_cur)->sk_data_ready(*others_cur, size);
+ others_cur++;
+ }
+ kfree_skb(skb);
+ fds_sent = true;
sent += size;
}
scm_destroy(siocb->scm);
siocb->scm = NULL;
+ if (others)
+ kfree(others);
return sent;
-pipe_err_free:
- unix_state_unlock(other);
- kfree_skb(skb);
pipe_err:
if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
send_sig(SIGPIPE, current, 0);
@@ -1762,6 +1789,8 @@ pipe_err:
out_err:
scm_destroy(siocb->scm);
siocb->scm = NULL;
+ if (others)
+ kfree(others);
return sent ? : err;
}
--
1.7.1
^ permalink raw reply related
* [PATCH 3/5] AF_UNIX: implement connect() on multicast Unix stream socket
From: Alban Crequy @ 2010-09-24 17:25 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Eric Dumazet, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus, Alban Crequy
In-Reply-To: <20100924182257.11abd9a6@chocolatine.cbg.collabora.co.uk>
All multicast peers use connect() without any bound socket.
Multicast Unix socket addresses and non-multicast Unix socket addresses live in
the same namespace. An userspace application cannot connect() a non-multicast
socket if the address is already used for multicast sockets.
Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
---
net/unix/af_unix.c | 22 ++++++++++++++++++++--
1 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c766e88..a8d9de7 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1064,9 +1064,20 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
restart:
/* Find listening sock. */
other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, &err);
- if (!other)
+ if (!other && !u->multicast)
goto out;
+ if (other && u->multicast) {
+ err = -ECONNREFUSED;
+ goto out;
+ }
+
+ if (u->multicast) {
+ sock->state = SS_CONNECTED;
+ sk->sk_state = TCP_ESTABLISHED;
+ return 0;
+ }
+
/* Latch state of peer */
unix_state_lock(other);
@@ -1567,6 +1578,7 @@ int unix_stream_getsockopt(struct socket *sock, int level, int optname,
static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
struct msghdr *msg, size_t len)
{
+ struct unix_sock *u = unix_sk(sock->sk);
struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
struct sock *sk = sock->sk;
struct sock *other = NULL;
@@ -1591,12 +1603,18 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
if (msg->msg_namelen) {
err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
goto out_err;
- } else {
+ } else if (!u->multicast) {
sunaddr = NULL;
err = -ENOTCONN;
other = unix_peer(sk);
if (!other)
goto out_err;
+ } else {
+ sunaddr = NULL;
+ err = -ENOTCONN;
+ other = NULL; /* FIXME: get the list of other connection */
+ if (!other)
+ goto out_err;
}
if (sk->sk_shutdown & SEND_SHUTDOWN)
--
1.7.1
^ permalink raw reply related
* [PATCH 2/5] AF_UNIX: enable/disable multicast with getsockopt/setsockopt
From: Alban Crequy @ 2010-09-24 17:25 UTC (permalink / raw)
To: Alban Crequy
Cc: David S. Miller, Eric Dumazet, Stephen Hemminger, Cyrill Gorcunov,
Alexey Dobriyan, Lennart Poettering, Kay Sievers, Ian Molton,
netdev, linux-kernel, dbus, Alban Crequy
In-Reply-To: <20100924182257.11abd9a6@chocolatine.cbg.collabora.co.uk>
Multicast can be enabled or disabled after a socket is allocated but this
cannot be changed once the socket is bound or connected.
Userspace applications can enable multicast on an Unix stream socket:
sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
#define UNIX_MULTICAST 1
val = 1;
len = sizeof(val);
ret = setsockopt(sockfd, 0, UNIX_MULTICAST, &val, len);
Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
---
include/net/af_unix.h | 4 +++
net/unix/af_unix.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 59 insertions(+), 2 deletions(-)
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 20725e2..4c77c69 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -40,6 +40,9 @@ struct unix_skb_parms {
spin_lock_nested(&unix_sk(s)->lock, \
SINGLE_DEPTH_NESTING)
+/* UNIX socket options */
+#define UNIX_MULTICAST 1 /* Enable multicast Unix sockets */
+
#ifdef __KERNEL__
/* The AF_UNIX socket */
struct unix_sock {
@@ -56,6 +59,7 @@ struct unix_sock {
spinlock_t lock;
unsigned int gc_candidate : 1;
unsigned int gc_maybe_cycle : 1;
+ unsigned int multicast : 1;
struct socket_wq peer_wq;
};
#define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 47d9f77..c766e88 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1501,13 +1501,66 @@ out:
static int unix_stream_setsockopt(struct socket *sock, int level, int optname,
char __user *optval, unsigned int optlen)
{
- return -EOPNOTSUPP;
+ struct unix_sock *u = unix_sk(sock->sk);
+ int val;
+ int err = 0;
+
+ if (optlen < sizeof(int))
+ return -EINVAL;
+
+ if (get_user(val, (int __user *)optval))
+ return -EFAULT;
+
+ switch (optname) {
+ case UNIX_MULTICAST:
+ /* Multicast feature can only be changed when the socket is
+ * not used yet */
+ if (u->addr || sock->sk->sk_state != TCP_CLOSE)
+ return -EINVAL;
+
+ if (val != 0) {
+ u->multicast = 1;
+ } else {
+ u->multicast = 0;
+ }
+ break;
+
+ default:
+ err = -ENOPROTOOPT;
+ break;
+ }
+
+ return err;
}
int unix_stream_getsockopt(struct socket *sock, int level, int optname,
char __user *optval, int __user *optlen)
{
- return -EOPNOTSUPP;
+ struct unix_sock *u = unix_sk(sock->sk);
+ int val, len;
+
+ if (get_user(len, optlen))
+ return -EFAULT;
+
+ len = min_t(unsigned int, len, sizeof(int));
+
+ if (len < 0)
+ return -EINVAL;
+
+ switch (optname) {
+ case UNIX_MULTICAST:
+ val = u->multicast;
+ break;
+
+ default:
+ return -ENOPROTOOPT;
+ }
+
+ if (put_user(len, optlen))
+ return -EFAULT;
+ if (copy_to_user(optval, &val, len))
+ return -EFAULT;
+ return 0;
}
--
1.7.1
^ permalink raw reply related
* Re: [ABI REVIEW][PATCH 0/8] Namespace file descriptors
From: Eric W. Biederman @ 2010-09-24 17:06 UTC (permalink / raw)
To: Daniel Lezcano
Cc: Andrew Lutomirski, Sukadev Bhattiprolu, Pavel Emelyanov,
Pavel Emelyanov, Ulrich Drepper, netdev, Jonathan Corbet,
linux-kernel, Jan Engelhardt, linux-fsdevel, netfilter-devel,
Michael Kerrisk, Linux Containers, Ben Greear, Linus Torvalds,
David Miller, Al Viro
In-Reply-To: <4C9CAC7C.2080900@free.fr>
Daniel Lezcano <daniel.lezcano@free.fr> writes:
> On 09/24/2010 03:02 PM, Andrew Lutomirski wrote:
>> Eric W. Biederman wrote:
>>> Introduce file for manipulating namespaces and related syscalls.
>>> files:
>>> /proc/self/ns/<nstype>
>>>
>>> syscalls:
>>> int setns(unsigned long nstype, int fd);
>>> socketat(int nsfd, int family, int type, int protocol);
>>>
>>
>> How does security work? Are there different kinds of fd that give (say) pin-the-namespace permission, socketat permission, and setns permission?
>
> AFAICS, socketat, setns and "set netns by fd" only accept fd from
> /proc/<pid>/ns/<ns>.
>
> setns does :
>
> file = proc_ns_fget(fd);
> if (IS_ERR(file))
> return PTR_ERR(file);
>
> proc_ns_fget checks if (file->f_op != &ns_file_operations)
>
>
> socketat and get_net_ns_by_fd:
>
> net = get_net_ns_by_fd(fd);
>
> this one calls proc_ns_fget.
>
> We have the guarantee here, the fd is resulting from an open of the file with
> the right permissions.
In particular the default /proc permissions say you have to be the owner
of the process (or root) to access the file. If you are the owner of
the process with a namespace (or root) you already have permission to
access and manipulate the namespace.
Additionally setns like unshare requires CAP_SYS_ADMIN (aka root magic).
> Another way to pin the namespace, would be to mount --bind /proc/<pid>/ns/<ns>
> but we have to be root to do that ...
Simply keeping the process running, pins the namespace. That requires no
new permissions.
Similarly socketat. It is possible to use unix domain sockets to
implement it today without any kernel changes. It is just an
unnecessary pain to run a server process to pin a namespace or to serve
up file descriptors in other network namespaces.
The primary change of this patchset is the ability to do everything
with file descriptors, and with the mount namespace. That moves
everything from a bizarre hard to understand and manipulate interface
to one where things can be done much more easily, and cheaply.
Resulting in a much more powerful and usable interface.
Eric
^ permalink raw reply
* Re: [RFC PATCH] dont create cached routes from ARP requests
From: Eric Dumazet @ 2010-09-24 16:58 UTC (permalink / raw)
To: Ulrich Weber; +Cc: Ulrich Weber, David Miller, netdev
In-Reply-To: <4C9CD466.4010909@astaro.com>
Le vendredi 24 septembre 2010 à 18:40 +0200, Ulrich Weber a écrit :
> On 09/24/2010 06:05 PM, Eric Dumazet wrote:
> > Le vendredi 24 septembre 2010 à 17:38 +0200, Ulrich Weber a écrit :
> >> steps to reproduce:
> >> server:
> >> ip route add 1.0.0.0/8 dev dummy0
> >>
> >> client:
> >> ip route add 1.0.0.0/8 dev eth0
> >> nmap --min-rate 500 -sP 1.0.0.0/8
> >>
> >
> > Great, you use nmap and fill 'client' neighbour cache.
>
> Nope, I fills the 'server' neighbor cache too
> due cached routes in arp_process():
> if (arp->ar_op == htons(ARPOP_REQUEST) &&
> ip_route_input_noref(skb, tip, sip, 0, dev) == 0)
It fills the "server neighbor cache" because you specifically said it
has 2^24 ip addresses.
If using a normal route to gateway on eth0, it only fills route cache,
with a max of 65536 slots on your config, not 1024. When max is reached,
garbage collection takes place.
>
> > Now, back to the _real_ problem, please ?
> >
> > <quote>
> >
> > Background: At home I have two Internet connections, DSL and Cable.
> > DSL is the primary uplink while Cable is the secondary.
> > My Cable ISP is flooding me with ARP request from 10.0.0.0/8,
> > which creates routes via the primary uplink.
> > There are thousands of cached routes and after some time
> > I get "Neighbour table overflow" messages.
> >
> > </quote>
> >
> > You receive an ARP request on device eth1,
> > this creates a route on eth0 ?
> >
> > Could you send your routing/address setup ?
> >
> > ip addr
> > ip ro
> >
>
> ARP request flood comes in via eth2.
>
> Have to correct myself: With configuration below only route cache
> increases but no "Neighbour table overflow".
>
> By adding "ip route add 10.0.0.0/8 dev eth0" the Neighbor table overflow
> will occur.
>
Because you want instead "ip route add 10.0.0.0/8 via gateway"
Or else you are vulnerable to an attack, as you discovered.
Here it works perfectly.
rtstat -c20 -i1|cut -c1-60
rt_cache|rt_cache|rt_cache|rt_cache|rt_cache|rt_cache|rt_cac
entries| in_hit|in_slow_|in_slow_|in_no_ro| in_brd|in_mar
| | tot| mc| ute| | an_d
1984| 2| 1| 0| 0| 0|
1984| 2| 0| 0| 0| 0|
1984| 2| 0| 0| 0| 0|
1985| 4| 2| 0| 0| 0|
1988| 0| 4| 0| 0| 0|
2020| 1| 33| 0| 0| 0|
2042| 1| 23| 0| 0| 0|
2104| 0| 63| 0| 0| 0|
2117| 0| 14| 0| 0| 0|
2141| 0| 26| 0| 0| 0|
2159| 1| 19| 0| 0| 0|
2175| 0| 17| 0| 0| 0|
2221| 0| 48| 0| 0| 0|
2241| 0| 20| 0| 0| 0|
2256| 0| 17| 0| 0| 0|
2269| 3| 15| 0| 0| 0|
2286| 0| 17| 0| 0| 0|
2295| 1| 10| 0| 0| 0|
2326| 1| 33| 0| 0| 0|
>
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
> inet 127.0.0.1/8 scope host lo
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
> inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
> 4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
> inet 78.43.x.x/22 brd 78.43.35.255 scope global eth2
> 12: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc hfsc
> state UNKNOWN qlen 3
> inet 95.114.x.x peer 213.20.56.129/32 scope global ppp0
>
>
> default via 213.20.56.129 dev ppp0
> 78.43.32.0/22 dev eth2 proto kernel scope link src 78.43.x.x
> 127.0.0.0/8 dev lo scope link
> 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
> 213.20.56.129 dev ppp0 proto kernel scope link src 95.114.x.x
>
>
Thanks
^ permalink raw reply
* Re: [PATCH net-next-2.6] rps: allocate rx queues in register_netdevice only
From: John Fastabend @ 2010-09-24 16:54 UTC (permalink / raw)
To: Eric Dumazet
Cc: Ben Hutchings, David Miller, netdev@vger.kernel.org,
linux-net-drivers@solarflare.com, Tom Herbert
In-Reply-To: <1285320110.2503.42.camel@edumazet-laptop>
On 9/24/2010 2:21 AM, Eric Dumazet wrote:
> Le vendredi 24 septembre 2010 à 01:15 -0700, John Fastabend a écrit :
>> On 9/23/2010 8:26 PM, Eric Dumazet wrote:
>>>
>>>> Also, I dont understand why we need to restrict
>>>> netif_set_real_num_rx_queues() to lower the count.
>>>> This wastes memory.
>>>>
>>>> Why dont we allocate dev->_rx once we know the real count, not in
>>>> alloc_netdev_mq() but in register_netdevice() ?
>>>>
>>
>> Eric,
>>
>> At least in the TX case we may not "know" until later how many
>> tx_queues we want to use. For example it could change based on
>> enabling/disabling features or available interrupts. So we use
>> num_tx_queues as the max we ever expect to use and then
>> netif_set_real_num_tx_queues() sets the number we want to use.
>>
>> I presume for rx queues there are similar cases where features and
>> available interrupts may determine how many rx queues are needed.
>>
>> Moving the allocation later could help drivers make better max number
>> of queue decisions. But, I think we still need the
>> netif_set_num_rx_queues() and netif_set_num_tx_queues(). Although this
>> does end up wasting memory as you pointed out.
>>
>
> Note I am not against having netif_set_num_rx_queues() and
> netif_set_num_tx_queues(). My patch was a cleanup, not an alternative.
>
>
> If I take a look at sysfs stuff, on a machine with a bnx2 adapter,
> single queue, I get :
>
> /sys/class/net/eth0/queues/rx-0/rps_cpus
> /sys/class/net/eth0/queues/rx-0/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-1/rps_cpus
> /sys/class/net/eth0/queues/rx-1/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-2/rps_cpus
> /sys/class/net/eth0/queues/rx-2/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-3/rps_cpus
> /sys/class/net/eth0/queues/rx-3/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-4/rps_cpus
> /sys/class/net/eth0/queues/rx-4/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-5/rps_cpus
> /sys/class/net/eth0/queues/rx-5/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-6/rps_cpus
> /sys/class/net/eth0/queues/rx-6/rps_flow_cnt
> /sys/class/net/eth0/queues/rx-7/rps_cpus
> /sys/class/net/eth0/queues/rx-7/rps_flow_cnt
>
> Thats a lot of extra memory and administrator confusion.
>
> We all agree :)
>
>
Thanks for the clarification Eric.
^ permalink raw reply
* Re: [RFC PATCH] dont create cached routes from ARP requests
From: Ulrich Weber @ 2010-09-24 16:40 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Ulrich Weber, David Miller, netdev
In-Reply-To: <1285344352.2503.321.camel@edumazet-laptop>
On 09/24/2010 06:05 PM, Eric Dumazet wrote:
> Le vendredi 24 septembre 2010 à 17:38 +0200, Ulrich Weber a écrit :
>> steps to reproduce:
>> server:
>> ip route add 1.0.0.0/8 dev dummy0
>>
>> client:
>> ip route add 1.0.0.0/8 dev eth0
>> nmap --min-rate 500 -sP 1.0.0.0/8
>>
>
> Great, you use nmap and fill 'client' neighbour cache.
Nope, I fills the 'server' neighbor cache too
due cached routes in arp_process():
if (arp->ar_op == htons(ARPOP_REQUEST) &&
ip_route_input_noref(skb, tip, sip, 0, dev) == 0)
> Now, back to the _real_ problem, please ?
>
> <quote>
>
> Background: At home I have two Internet connections, DSL and Cable.
> DSL is the primary uplink while Cable is the secondary.
> My Cable ISP is flooding me with ARP request from 10.0.0.0/8,
> which creates routes via the primary uplink.
> There are thousands of cached routes and after some time
> I get "Neighbour table overflow" messages.
>
> </quote>
>
> You receive an ARP request on device eth1,
> this creates a route on eth0 ?
>
> Could you send your routing/address setup ?
>
> ip addr
> ip ro
>
ARP request flood comes in via eth2.
Have to correct myself: With configuration below only route cache
increases but no "Neighbour table overflow".
By adding "ip route add 10.0.0.0/8 dev eth0" the Neighbor table overflow
will occur.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP qlen 1000
inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP qlen 1000
inet 78.43.x.x/22 brd 78.43.35.255 scope global eth2
12: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc hfsc
state UNKNOWN qlen 3
inet 95.114.x.x peer 213.20.56.129/32 scope global ppp0
default via 213.20.56.129 dev ppp0
78.43.32.0/22 dev eth2 proto kernel scope link src 78.43.x.x
127.0.0.0/8 dev lo scope link
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
213.20.56.129 dev ppp0 proto kernel scope link src 95.114.x.x
--
Ulrich Weber | uweber@astaro.com | Software Engineer
Astaro GmbH & Co. KG | www.astaro.com | Phone +49-721-25516-0 | Fax –200
An der RaumFabrik 33a | 76227 Karlsruhe | Germany
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox