netdev - Re: [PATCH v2 net-next 4/7] ipv6: Plumb support for nexthop object in a fib6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dec5c727-4002-913f-a858-362e0d926b8d@gmail.com>
Date:   Mon, 3 Jun 2019 14:42:10 -0600
From:   David Ahern <dsahern@...il.com>
To:     Wei Wang <weiwan@...gle.com>, David Ahern <dsahern@...nel.org>
Cc:     "David S . Miller" <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        idosch@...lanox.com, saeedm@...lanox.com,
        Martin KaFai Lau <kafai@...com>
Subject: Re: [PATCH v2 net-next 4/7] ipv6: Plumb support for nexthop object in
 a fib6_info

On 6/3/19 12:09 PM, Wei Wang wrote:
>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
>> index fada5a13bcb2..51cb5cb027ae 100644
>> --- a/net/ipv6/route.c
>> +++ b/net/ipv6/route.c
>> @@ -432,15 +432,21 @@ void fib6_select_path(const struct net *net, struct fib6_result *res,
>>         struct fib6_info *sibling, *next_sibling;
>>         struct fib6_info *match = res->f6i;
>>
>> -       if (!match->fib6_nsiblings || have_oif_match)
>> +       if ((!match->fib6_nsiblings && !match->nh) || have_oif_match)
>>                 goto out;
> 
> So you mentioned fib6_nsiblings and nexthop is mutually exclusive. Is
> it enforced from the configuration?

It is enforced by the patch that wires up RTA_NH_ID for IPv6.

>> @@ -1982,6 +2010,14 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
>>                 rcu_read_unlock();
>>                 dst_hold(&rt->dst);
>>                 return rt;
>> +       } else if (res.fib6_flags & RTF_REJECT) {
>> +               rt = ip6_create_rt_rcu(&res);
>> +               rcu_read_unlock();
>> +               if (!rt) {
>> +                       rt = net->ipv6.ip6_null_entry;
>> +                       dst_hold(&rt->dst);
>> +               }
>> +               return rt;
>>         }
>>
> Why do we need to call ip6_create_rt_rcu() to create a dst cache? Can
> we directly return ip6_null_entry here? This route is anyway meant to
> drop the packet. Same goes for the change in ip6_pol_route_lookup().

This is to mimic what happens if you added a route like this:
   ip -6 ro add blackhole 2001:db8:99::/64

except now the blackhole target is contained in the nexthop spec.


> 
> And for my education, how does this new nexthop logic interact with
> the pcpu_rt cache and the exception table? Those 2 are currently
> stored in struct fib6_nh. They are shared with fib6_siblings under the
> same fib6_info. Are they also shared with nexthop for the same
> fib6_info?

With nexthop objects IPv6 can work very similar to IPv4. Multiple IPv4
fib entries (fib_alias) can reference the same fib_info where the
fib_info contains an array of fib_nh and the cached routes and
exceptions are stored in the fib_nh.

The one IPv6 attribute that breaks the model is source routing which is
a function of the prefix. For that reason you can not use nexthop
objects with fib entries using source routing. See the note in this
patch in fib6_check_nexthop

> I don't see much changes around that area. So I assume they work as is?

Prior patch sets moved the pcpu and exception caches from fib6_info to
fib6_nh.