netdev - Re: [PATCH RFC net-next 4/4] ipv6: route: dissect flow in input path if fib rules need it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Feb 2018 08:21:55 -0800
From:   Roopa Prabhu <roopa@...ulusnetworks.com>
To:     Ido Schimmel <idosch@...sch.org>
Cc:     netdev@...r.kernel.org, David Ahern <dsa@...ulusnetworks.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
Subject: Re: [PATCH RFC net-next 4/4] ipv6: route: dissect flow in input path
 if fib rules need it

On Sun, Feb 11, 2018 at 11:44 PM, Ido Schimmel <idosch@...sch.org> wrote:
> On Sun, Feb 11, 2018 at 02:26:29PM -0800, Roopa Prabhu wrote:
>> From: Roopa Prabhu <roopa@...ulusnetworks.com>
>>
>> Dissect flow in fwd path if fib rules require it. Controlled by
>> a flag to avoid penatly for the common case. Flag is set when fib
>> rules with sport, dport and proto match that require flow dissect
>> are installed. Also passes the dissected hash keys to the multipath
>> hash function when applicable to avoid dissecting the flow again.
>> icmp packets will continue to use inner header for hash
>> calculations.
>>
>> Signed-off-by: Roopa Prabhu <roopa@...ulusnetworks.com>
>> ---
>>  include/net/ip6_route.h  |  3 ++-
>>  include/net/netns/ipv6.h |  1 +
>>  net/ipv6/fib6_rules.c    | 12 +++++++++---
>>  net/ipv6/icmp.c          |  2 +-
>>  net/ipv6/route.c         | 45 ++++++++++++++++++++++++++++++++++++---------
>>  5 files changed, 49 insertions(+), 14 deletions(-)
>>
>> diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
>> index 27d23a6..218f89c 100644
>> --- a/include/net/ip6_route.h
>> +++ b/include/net/ip6_route.h
>> @@ -127,7 +127,8 @@ static inline int ip6_route_get_saddr(struct net *net, struct rt6_info *rt,
>>
>>  struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
>>                           const struct in6_addr *saddr, int oif, int flags);
>> -u32 rt6_multipath_hash(const struct flowi6 *fl6, const struct sk_buff *skb);
>> +u32 rt6_multipath_hash(const struct flowi6 *fl6, const struct sk_buff *skb,
>> +                    struct flow_keys *hkeys);
>>
>>  struct dst_entry *icmp6_dst_alloc(struct net_device *dev, struct flowi6 *fl6);
>>
>> diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
>> index 987cc45..7aca00e 100644
>> --- a/include/net/netns/ipv6.h
>> +++ b/include/net/netns/ipv6.h
>> @@ -72,6 +72,7 @@ struct netns_ipv6 {
>>       unsigned long            ip6_rt_last_gc;
>>  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
>>       bool                     fib6_has_custom_rules;
>> +     bool                     fib6_rules_require_fldissect;
>>       struct rt6_info         *ip6_prohibit_entry;
>>       struct rt6_info         *ip6_blk_hole_entry;
>>       struct fib6_table       *fib6_local_tbl;
>
> [...]
>
>> @@ -1847,12 +1858,27 @@ void ip6_route_input(struct sk_buff *skb)
>>               .flowi6_mark = skb->mark,
>>               .flowi6_proto = iph->nexthdr,
>>       };
>> +     struct flow_keys *flkeys = NULL, _flkeys;
>>
>>       tun_info = skb_tunnel_info(skb);
>>       if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
>>               fl6.flowi6_tun_key.tun_id = tun_info->key.tun_id;
>> +
>> +#ifdef CONFIG_IP_MULTIPLE_TABLES
>
> s/CONFIG_IP_MULTIPLE_TABLES/CONFIG_IPV6_MULTIPLE_TABLES/ ?
>

ack, will fix,  thanks ido.