lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 21 Dec 2017 11:33:25 -0800
From:   Tom Herbert <tom@...ntonium.net>
To:     davem@...emloft.net
Cc:     netdev@...r.kernel.org, roopa@...ulusnetworks.com,
        rohit@...ntonium.net, Tom Herbert <tom@...ntonium.net>
Subject: [PATCH v5 net-next 0/7] net: ILA notification mechanism and fixes

This patch set adds support to get netlink notifications for ILA 
routes when a route is used.

This patch set contains:

- General infrastructure for route notifications
- The ILA route notification mechanism
- Add net to ila build_state
- Add flush command to ila_xlat
- Fix use of rhashtable for latest fixes

Route notifications will be used in conjunction with populating
ILA forwarding caches. There are three methods described in
the ILA Mapping Protocol. These are redirects, request/reply,
and push. The ILA route mechanism is relevant to the first two methods.

  - ILA router secure redirect mechanism-- This is used on an ILA
    router where a notification is sent when an ILA host route is
    used. The purpose of this notification is to send an
    ILA redirect towards the ILA forwarding node of a source to
    inform it of a direct ILA route. When the forwarding node
    receives the redirect it can populate its cache so that
    subsequent packets take the direct path. This is the
    RECOMMENDED method.

  - Cache address resolution-- This used to perform request/reply
    address resolution on a route. As noted on netdev list, a
    request/reply mechanism is susceptible to DOS attacks.
    For this reason, this method is not NOT RECOMMENDED as the
    primary means to populate an ILA cache.

ILAMP is described in 
https://www.ietf.org/internet-drafts/draft-herbert-ila-ilamp-00.txt

Tested:

Ran ILA traffic, set up ILA notify routes and observed correct
routing message via ip monitor.

v5:
 - Fix some compiler and sparse warnings
 - Generalize route notify with RTM_NOTIFYROUTE,
   RTNLGRP_ROUTE_NOTIFY (suggested by Roopa)

v4:
 - Remove front end cache per davem feedback
 - Eliminate separate LWT type just use ILA LWT already in place

v3:
 - Removed rhashtable changes to their own patch set
 - Restructure ILA code to be more amenable to changes
 - Remove extra call back functions in resolution interface

Changes from initial RFC:

 - Added net argument to LWT build_state
 - Made resolve timeout an attribute of the LWT encap route
 - Changed ILA notifications to be regular routing messages of event
   RTM_ADDR_RESOLVE, family RTNL_FAMILY_ILA, and group
   RTNLGRP_ILA_NOTIFY

Tom Herbert (7):
  lwt: Add net to build_state argument
  rtnetlink: Add notify route message types
  ila: Fix use of rhashtable walk in ila_xlat.c
  ila: Call library function alloc_bucket_locks
  ila: Create main ila source file
  ila: Flush netlink command to clear xlat table
  ila: Route notify

 include/net/lwtunnel.h         |   6 +-
 include/uapi/linux/ila.h       |   3 +
 include/uapi/linux/rtnetlink.h |   6 +
 net/core/lwt_bpf.c             |   2 +-
 net/core/lwtunnel.c            |   4 +-
 net/ipv4/fib_semantics.c       |  13 +-
 net/ipv4/ip_tunnel_core.c      |   4 +-
 net/ipv6/ila/Makefile          |   2 +-
 net/ipv6/ila/ila.h             |  27 +++-
 net/ipv6/ila/ila_common.c      |  30 -----
 net/ipv6/ila/ila_lwt.c         | 275 ++++++++++++++++++++++++++------------
 net/ipv6/ila/ila_main.c        | 121 +++++++++++++++++
 net/ipv6/ila/ila_xlat.c        | 290 ++++++++++++++++++++---------------------
 net/ipv6/route.c               |   2 +-
 net/ipv6/seg6_iptunnel.c       |   2 +-
 net/ipv6/seg6_local.c          |   5 +-
 net/mpls/mpls_iptunnel.c       |   2 +-
 17 files changed, 511 insertions(+), 283 deletions(-)
 create mode 100644 net/ipv6/ila/ila_main.c

-- 
2.11.0

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ