Skip to content

L
linux
Switch branch/tag
  1. 21 Jul, 2020 1 commit
  3. 17 Jul, 2020 2 commits
    • Xin Long's avatar
      ip6_vti: use IS_REACHABLE to avoid some compile errors · 96a20829
      Xin Long authored 
      Naresh reported some compile errors:

  arm build failed due this error on linux-next 20200713 and  20200713
  net/ipv6/ip6_vti.o: In function `vti6_rcv_tunnel':
  ip6_vti.c:(.text+0x1d20): undefined reference to `xfrm6_tunnel_spi_lookup'

This happened when set CONFIG_IPV6_VTI=y and CONFIG_INET6_TUNNEL=m.
We don't really want ip6_vti to depend inet6_tunnel completely, but
only to disable the tunnel code when inet6_tunnel is not seen.

So instead of adding "select INET6_TUNNEL" for IPV6_VTI, this patch
is only to change to IS_REACHABLE to avoid these compile error.
Reported-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
Fixes: 08622869 ("ip6_vti: support IP6IP6 tunnel processing with .cb_handler")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      96a20829
    • Xin Long's avatar
      xfrm: interface: use IS_REACHABLE to avoid some compile errors · 0a0d93b9
      Xin Long authored 
      kernel test robot reported some compile errors:

  ia64-linux-ld: net/xfrm/xfrm_interface.o: in function `xfrmi4_fini':
  net/xfrm/xfrm_interface.c:900: undefined reference to `xfrm4_tunnel_deregister'
  ia64-linux-ld: net/xfrm/xfrm_interface.c:901: undefined reference to `xfrm4_tunnel_deregister'
  ia64-linux-ld: net/xfrm/xfrm_interface.o: in function `xfrmi4_init':
  net/xfrm/xfrm_interface.c:873: undefined reference to `xfrm4_tunnel_register'
  ia64-linux-ld: net/xfrm/xfrm_interface.c:876: undefined reference to `xfrm4_tunnel_register'
  ia64-linux-ld: net/xfrm/xfrm_interface.c:885: undefined reference to `xfrm4_tunnel_deregister'

This happened when set CONFIG_XFRM_INTERFACE=y and CONFIG_INET_TUNNEL=m.
We don't really want xfrm_interface to depend inet_tunnel completely,
but only to disable the tunnel code when inet_tunnel is not seen.

So instead of adding "select INET_TUNNEL" for XFRM_INTERFACE, this patch
is only to change to IS_REACHABLE to avoid these compile error.
Reported-by: default avatarkernel test robot <lkp@intel.com>
Fixes: da9bbf05 ("xfrm: interface: support IPIP and IPIP6 tunnels processing with .cb_handler")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      0a0d93b9
  5. 16 Jul, 2020 1 commit
    • Steffen Klassert's avatar
      Merge remote-tracking branch 'origin/testing' · 0a82f3f0
      Steffen Klassert authored 
      Xin Long says:

====================
xfrm: not register one xfrm(6)_tunnel object twice

Now in ip(6)_vti and xfrm interface tunnel support, it uses the
same xfrm(6)_tunnel object to handle for AF_NET and AF_INET6 by
registering it twice.

However the xfrm(6)_tunnel object is linked into a list with its
'next' pointer. The second registering will cause its 'next'
pointer to be overwritten, and break the list.

So this patchset is to add a new xfrm(6)_tunnel object for each
of them and register it, although its members are the same with
the old one.
====================
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      0a82f3f0
  7. 14 Jul, 2020 4 commits
    • Xin Long's avatar
      xfrm: interface: not xfrmi_ipv6/ipip_handler twice · 8b404f46
      Xin Long authored 
      As we did in the last 2 patches for vti(6), this patch is to define a
new xfrm_tunnel object 'xfrmi_ipip6_handler' to register for AF_INET6,
and a new xfrm6_tunnel object 'xfrmi_ip6ip_handler' to register for
AF_INET.
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      8b404f46
    • Xin Long's avatar
      ip6_vti: not register vti_ipv6_handler twice · a8757147
      Xin Long authored 
      An xfrm6_tunnel object is linked into the list when registering,
so vti_ipv6_handler can not be registered twice, otherwise its
next pointer will be overwritten on the second time.

So this patch is to define a new xfrm6_tunnel object to register
for AF_INET.

Fixes: 2ab110cb ("ip6_vti: support IP6IP tunnel processing")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      a8757147
    • Xin Long's avatar
      ip_vti: not register vti_ipip_handler twice · 55a48c7e
      Xin Long authored 
      An xfrm_tunnel object is linked into the list when registering,
so vti_ipip_handler can not be registered twice, otherwise its
next pointer will be overwritten on the second time.

So this patch is to define a new xfrm_tunnel object to register
for AF_INET6.

Fixes: e6ce6457 ("ip_vti: support IPIP6 tunnel processing")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      55a48c7e
    • Steffen Klassert's avatar
      Merge remote-tracking branch 'origin/testing' · 910a71ed
      Steffen Klassert authored 
      Eyal Birger says:

====================
When having many xfrm interfaces, the linear lookup of devices based on
if_id becomes costly.

The first patch refactors xfrmi_decode_session() to use the xi used in
the netdevice priv context instead of looking it up in the list based
on ifindex. This is needed in order to use if_id as the only key used
for xi lookup.

The second patch extends the existing infrastructure - which already
stores the xfrmi contexts in an array of lists - to use a hash of the
if_id.

Example benchmarks:
- running on a KVM based VM
- xfrm tunnel mode between two namespaces
- xfrm interface in one namespace (10.0.0.2)

Before this change set:

Single xfrm interface in namespace:
$ netperf -H 10.0.0.2 -l8 -I95,10 -t TCP_STREAM

MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.2 () port 0 AF_INET : +/-5.000% @ 95% conf.  : demo
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

131072  16384  16384    8.00      298.36

After adding 400 xfrmi interfaces in the same namespace:

$ netperf -H 10.0.0.2 -l8 -I95,10 -t TCP_STREAM

MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.2 () port 0 AF_INET : +/-5.000% @ 95% conf.  : demo
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

131072  16384  16384    8.00      221.77

After this patchset there was no observed change after adding the
xfrmi interfaces.
====================
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      910a71ed
  9. 13 Jul, 2020 2 commits
  11. 10 Jul, 2020 1 commit
    • Steffen Klassert's avatar
      Merge remote-tracking branch 'origin/testing' · 2d4c7986
      Steffen Klassert authored 
      Xin Long says:

==================
Now ipip and ipv6 tunnels processing is supported by xfrm4/6_tunnel,
but not in vti and xfrmi. This feature is needed by processing those
uncompressed small fragments and packets when using comp protocol.
It means vti and xfrmi won't be able to accept small fragments or
packets when using comp protocol, which is not expected.

xfrm4/6_tunnel eventually calls xfrm_input() to process ipip and ipv6
tunnels with an ipip/ipv6-proto state (a child state of comp-proto
state), and vti and xfrmi should do the same.

The extra things for vti to do is:

  - vti_input() should be called before xfrm_input() to set
    XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4/6 = tunnel. [A]

  - vti_rcv_cb() should be called after xfrm_input() to update
    the skb->dev. [B]

And the extra things for xfrmi to do is:

   - The ipip/ipv6-proto state should be assigned if_id from its
     parent's state. [C]

   - xfrmi_rcv_cb() should be called after xfrm_input() to update
     the skb->dev. [D]

Patch 4-7 does the things in [A].

To implement [B] and [D], patch 1-3 is to build a callback function
for xfrm4/6_tunnel, which can be called after xfrm_input(), similar
to xfrm4/6_protocol's .cb_handler. vti and xfrmi only needs to give
their own callback function in patch 4-7 and 9-10, which already
exists: vti_rcv_cb() and xfrmi_rcv_cb().

Patch 8 is to do the thing in [C] by assigning child tunnel's if_id
from its parent tunnel.

With the whole patch series, the segments or packets with any size
can work with ipsec comp proto on vti and xfrmi.

v1->v2:
  - See Patch 2-3.
v2->v3:
  - See Patch 2-3, 4, 6, 9-10.
==================
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      2d4c7986
  13. 09 Jul, 2020 10 commits
  15. 24 Jun, 2020 1 commit
    • Petr Vaněk's avatar
      xfrm: introduce oseq-may-wrap flag · 428d2459
      Petr Vaněk authored 
      RFC 4303 in section 3.3.3 suggests to disable anti-replay for manually
distributed ICVs in which case the sender does not need to monitor or
reset the counter. However, the sender still increments the counter and
when it reaches the maximum value, the counter rolls over back to zero.

This patch introduces new extra_flag XFRM_SA_XFLAG_OSEQ_MAY_WRAP which
allows sequence number to cycle in outbound packets if set. This flag is
used only in legacy and bmp code, because esn should not be negotiated
if anti-replay is disabled (see note in 3.3.3 section).
Signed-off-by: default avatarPetr Vaněk <pv@excello.cz>
Acked-by: default avatarChristophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      428d2459
  17. 23 Jun, 2020 16 commits
  19. 22 Jun, 2020 2 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7