* [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once
@ 2013-10-23 9:06 Hannes Frederic Sowa
2013-10-23 9:06 ` [PATCH net-next 1/3] ipv4: initialize ip4_frags hash secret as late as possible Hannes Frederic Sowa
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Hannes Frederic Sowa @ 2013-10-23 9:06 UTC (permalink / raw)
To: netdev; +Cc: netfilter-devel
Hi!
This series switches the inet_frag.rnd hash initialization to
net_get_random_once.
Included patches:
ipv4: initialize ip4_frags hash secret as late
ipv6: split inet6_hash_frag for netfilter and
inet: remove old fragmentation hash initializing
Diffstat:
include/net/inet_frag.h | 4 ++++
include/net/ipv6.h | 2 --
net/ipv4/inet_fragment.c | 3 ---
net/ipv4/ip_fragment.c | 1 +
net/ipv6/netfilter/nf_conntrack_reasm.c | 16 ++++++++++++++--
net/ipv6/reassembly.c | 12 ++++++------
6 files changed, 25 insertions(+), 13 deletions(-)
Greetings,
Hannes
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH net-next 1/3] ipv4: initialize ip4_frags hash secret as late as possible 2013-10-23 9:06 [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once Hannes Frederic Sowa @ 2013-10-23 9:06 ` Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 2/3] ipv6: split inet6_hash_frag for netfilter and initialize secrets with net_get_random_once Hannes Frederic Sowa ` (2 subsequent siblings) 3 siblings, 0 replies; 5+ messages in thread From: Hannes Frederic Sowa @ 2013-10-23 9:06 UTC (permalink / raw) To: netdev; +Cc: netfilter-devel, Hannes Frederic Sowa, Eric Dumazet, David S. Miller Defer the generation of the first hash secret for the ipv4 fragmentation cache as late as possible. ip4_frags.rnd gets initial seeded by inet_frags_init and regulary reseeded by inet_frag_secret_rebuild. Either we call ipqhashfn directly from ip_fragment.c in which case we initialize the secret directly. If we first get called by inet_frag_secret_rebuild we install a new secret by a manual call to get_random_bytes. This secret will be overwritten as soon as the first call to ipqhashfn happens. This is safe because we won't race while publishing the new secrets with anyone else. Cc: Eric Dumazet <edumazet@google.com> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> --- net/ipv4/ip_fragment.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index b66910a..2481993 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -106,6 +106,7 @@ struct ip4_create_arg { static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) { + net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); return jhash_3words((__force u32)id << 16 | prot, (__force u32)saddr, (__force u32)daddr, ip4_frags.rnd) & (INETFRAGS_HASHSZ - 1); -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net-next 2/3] ipv6: split inet6_hash_frag for netfilter and initialize secrets with net_get_random_once 2013-10-23 9:06 [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 1/3] ipv4: initialize ip4_frags hash secret as late as possible Hannes Frederic Sowa @ 2013-10-23 9:06 ` Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 3/3] inet: remove old fragmentation hash initializing Hannes Frederic Sowa 2013-10-23 21:02 ` [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once David Miller 3 siblings, 0 replies; 5+ messages in thread From: Hannes Frederic Sowa @ 2013-10-23 9:06 UTC (permalink / raw) To: netdev Cc: netfilter-devel, Hannes Frederic Sowa, David S. Miller, Eric Dumazet, Pablo Neira Ayuso Defer the fragmentation hash secret initialization for IPv6 like the previous patch did for IPv4. Because the netfilter logic reuses the hash secret we have to split it first. Thus introduce a new nf_hash_frag function which takes care to seed the hash secret. Cc: David S. Miller <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> --- include/net/ipv6.h | 2 -- net/ipv6/netfilter/nf_conntrack_reasm.c | 16 ++++++++++++++-- net/ipv6/reassembly.c | 12 ++++++------ 3 files changed, 20 insertions(+), 10 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index a35055f..dd96638 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -805,8 +805,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk, int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf); int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, struct group_filter __user *optval, int __user *optlen); -unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, - const struct in6_addr *daddr, u32 rnd); #ifdef CONFIG_PROC_FS int ac6_proc_init(struct net *net); diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index dffdc1a..4a25826 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c @@ -144,12 +144,24 @@ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h) return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK); } +static unsigned int nf_hash_frag(__be32 id, const struct in6_addr *saddr, + const struct in6_addr *daddr) +{ + u32 c; + + net_get_random_once(&nf_frags.rnd, sizeof(nf_frags.rnd)); + c = jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), + (__force u32)id, nf_frags.rnd); + return c & (INETFRAGS_HASHSZ - 1); +} + + static unsigned int nf_hashfn(struct inet_frag_queue *q) { const struct frag_queue *nq; nq = container_of(q, struct frag_queue, q); - return inet6_hash_frag(nq->id, &nq->saddr, &nq->daddr, nf_frags.rnd); + return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr); } static void nf_skb_free(struct sk_buff *skb) @@ -185,7 +197,7 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id, arg.ecn = ecn; read_lock_bh(&nf_frags.lock); - hash = inet6_hash_frag(id, src, dst, nf_frags.rnd); + hash = nf_hash_frag(id, src, dst); q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash); local_bh_enable(); diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index 1aeb473..cc85a9b 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -82,24 +82,24 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, * callers should be careful not to use the hash value outside the ipfrag_lock * as doing so could race with ipfrag_hash_rnd being recalculated. */ -unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, - const struct in6_addr *daddr, u32 rnd) +static unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, + const struct in6_addr *daddr) { u32 c; + net_get_random_once(&ip6_frags.rnd, sizeof(ip6_frags.rnd)); c = jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), - (__force u32)id, rnd); + (__force u32)id, ip6_frags.rnd); return c & (INETFRAGS_HASHSZ - 1); } -EXPORT_SYMBOL_GPL(inet6_hash_frag); static unsigned int ip6_hashfn(struct inet_frag_queue *q) { struct frag_queue *fq; fq = container_of(q, struct frag_queue, q); - return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd); + return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr); } bool ip6_frag_match(struct inet_frag_queue *q, void *a) @@ -193,7 +193,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, arg.ecn = ecn; read_lock(&ip6_frags.lock); - hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd); + hash = inet6_hash_frag(id, src, dst); q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); if (IS_ERR_OR_NULL(q)) { -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net-next 3/3] inet: remove old fragmentation hash initializing 2013-10-23 9:06 [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 1/3] ipv4: initialize ip4_frags hash secret as late as possible Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 2/3] ipv6: split inet6_hash_frag for netfilter and initialize secrets with net_get_random_once Hannes Frederic Sowa @ 2013-10-23 9:06 ` Hannes Frederic Sowa 2013-10-23 21:02 ` [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once David Miller 3 siblings, 0 replies; 5+ messages in thread From: Hannes Frederic Sowa @ 2013-10-23 9:06 UTC (permalink / raw) To: netdev; +Cc: netfilter-devel, Hannes Frederic Sowa, David S. Miller, Eric Dumazet All fragmentation hash secrets now get initialized by their corresponding hash function with net_get_random_once. Thus we can eliminate the initial seeding. Also provide a comment that hash secret seeding happens at the first call to the corresponding hashing function. Cc: David S. Miller <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> --- include/net/inet_frag.h | 4 ++++ net/ipv4/inet_fragment.c | 3 --- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index bfcbc00..6f59de9 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -64,6 +64,10 @@ struct inet_frags { rwlock_t lock ____cacheline_aligned_in_smp; int secret_interval; struct timer_list secret_timer; + + /* The first call to hashfn is responsible to initialize + * rnd. This is best done with net_get_random_once. + */ u32 rnd; int qsize; diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index c5313a9..bb075fc 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -93,9 +93,6 @@ void inet_frags_init(struct inet_frags *f) } rwlock_init(&f->lock); - f->rnd = (u32) ((totalram_pages ^ (totalram_pages >> 7)) ^ - (jiffies ^ (jiffies >> 6))); - setup_timer(&f->secret_timer, inet_frag_secret_rebuild, (unsigned long)f); f->secret_timer.expires = jiffies + f->secret_interval; -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once 2013-10-23 9:06 [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once Hannes Frederic Sowa ` (2 preceding siblings ...) 2013-10-23 9:06 ` [PATCH net-next 3/3] inet: remove old fragmentation hash initializing Hannes Frederic Sowa @ 2013-10-23 21:02 ` David Miller 3 siblings, 0 replies; 5+ messages in thread From: David Miller @ 2013-10-23 21:02 UTC (permalink / raw) To: hannes; +Cc: netdev, netfilter-devel From: Hannes Frederic Sowa <hannes@stressinduktion.org> Date: Wed, 23 Oct 2013 11:06:54 +0200 > This series switches the inet_frag.rnd hash initialization to > net_get_random_once. > > Included patches: > ipv4: initialize ip4_frags hash secret as late > ipv6: split inet6_hash_frag for netfilter and > inet: remove old fragmentation hash initializing Looks good, series applied, thanks Hannes. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-10-23 21:02 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-10-23 9:06 [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 1/3] ipv4: initialize ip4_frags hash secret as late as possible Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 2/3] ipv6: split inet6_hash_frag for netfilter and initialize secrets with net_get_random_once Hannes Frederic Sowa 2013-10-23 9:06 ` [PATCH net-next 3/3] inet: remove old fragmentation hash initializing Hannes Frederic Sowa 2013-10-23 21:02 ` [PATCH net-next 0/3] initialize fragment hash secrets with net_get_random_once David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).