| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANn89iL3YFsZoOJpe=wp2uNiSvKFNbj8Kbxj11_iwk=8Sh0uuw@mail.gmail.com>
Date: Thu, 6 Mar 2025 17:35:40 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org, Willem de Bruijn <willemdebruijn.kernel@...il.com>,
"David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Simon Horman <horms@...nel.org>,
David Ahern <dsahern@...nel.org>
Subject: Re: [PATCH net-next 1/2] udp_tunnel: create a fast-path GRO lookup.
On Thu, Mar 6, 2025 at 4:57 PM Paolo Abeni <pabeni@...hat.com> wrote:
>
> Most UDP tunnels bind a socket to a local port, with ANY address, no
> peer and no interface index specified.
> Additionally it's quite common to have a single tunnel device per
> namespace.
>
> Track in each namespace the UDP tunnel socket respecting the above.
> When only a single one is present, store a reference in the netns.
>
> When such reference is not NULL, UDP tunnel GRO lookup just need to
> match the incoming packet destination port vs the socket local port.
>
> The tunnel socket never set the reuse[port] flag[s], when bound to no
> address and interface, no other socket can exist in the same netns
> matching the specified local port.
>
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> ---
...
> static int __net_init udp_pernet_init(struct net *net)
> {
> +#if IS_ENABLED(CONFIG_NET_UDP_TUNNEL)
> + int i;
> +
> + /* No tunnel is configured */
> + for (i = 0; i < ARRAY_SIZE(net->ipv4.udp_tunnel_gro); ++i) {
> + INIT_HLIST_HEAD(&net->ipv4.udp_tunnel_gro[i].list);
> + rcu_assign_pointer(net->ipv4.udp_tunnel_gro[1].sk, NULL);
typo : [i] is what you meant (instead of [1])
> + }
> +#endif
> udp_sysctl_init(net);
> udp_set_table(net);
>
> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
> index c1a85b300ee87..ac6dd2703190e 100644
> --- a/net/ipv4/udp_offload.c
> +++ b/net/ipv4/udp_offload.c
> @@ -12,6 +12,38 @@
> #include <net/udp.h>
> #include <net/protocol.h>
> #include <net/inet_common.h>
> +#include <net/udp_tunnel.h>
> +
> +#if IS_ENABLED(CONFIG_NET_UDP_TUNNEL)
> +static DEFINE_SPINLOCK(udp_tunnel_gro_lock);
> +
> +void udp_tunnel_update_gro_lookup(struct net *net, struct sock *sk, bool add)
> +{
> + bool is_ipv6 = sk->sk_family == AF_INET6;
> + struct udp_sock *tup, *up = udp_sk(sk);
> + struct udp_tunnel_gro *udp_tunnel_gro;
> +
> + spin_lock(&udp_tunnel_gro_lock);
> + udp_tunnel_gro = &net->ipv4.udp_tunnel_gro[is_ipv6];
> + if (add)
> + hlist_add_head(&up->tunnel_list, &udp_tunnel_gro->list);
> + else
> + hlist_del_init(&up->tunnel_list);
> +
> + if (udp_tunnel_gro->list.first &&
> + !udp_tunnel_gro->list.first->next) {
> + tup = hlist_entry(udp_tunnel_gro->list.first, struct udp_sock,
> + tunnel_list);
> +
> + rcu_assign_pointer(udp_tunnel_gro->sk, (struct sock *)tup);
> + } else {
> + rcu_assign_pointer(udp_tunnel_gro->sk, NULL);
> + }
> +
> + spin_unlock(&udp_tunnel_gro_lock);
> +}
> +EXPORT_SYMBOL_GPL(udp_tunnel_update_gro_lookup);
> +#endif
>
> static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
> netdev_features_t features,
> @@ -631,8 +663,13 @@ static struct sock *udp4_gro_lookup_skb(struct sk_buff *skb, __be16 sport,
> {
> const struct iphdr *iph = skb_gro_network_header(skb);
> struct net *net = dev_net_rcu(skb->dev);
> + struct sock *sk;
> int iif, sdif;
>
> + sk = udp_tunnel_sk(net, false);
> + if (sk && dport == htons(sk->sk_num))
> + return sk;
> +
> inet_get_iif_sdif(skb, &iif, &sdif);
>
> return __udp4_lib_lookup(net, iph->saddr, sport,
> diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
> index 619a53eb672da..b969c997c89c7 100644
> --- a/net/ipv4/udp_tunnel_core.c
> +++ b/net/ipv4/udp_tunnel_core.c
> @@ -58,6 +58,15 @@ int udp_sock_create4(struct net *net, struct udp_port_cfg *cfg,
> }
> EXPORT_SYMBOL(udp_sock_create4);
>
> +static inline bool sk_saddr_any(struct sock *sk)
> +{
> +#if IS_ENABLED(CONFIG_IPV6)
> + return ipv6_addr_any(&sk->sk_v6_rcv_saddr);
> +#else
> + return !sk->sk_rcv_saddr;
> +#endif
> +}
> +
> void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
> struct udp_tunnel_sock_cfg *cfg)
> {
> @@ -80,6 +89,9 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
> udp_sk(sk)->gro_complete = cfg->gro_complete;
>
> udp_tunnel_encap_enable(sk);
> +
> + if (!sk->sk_dport && !sk->sk_bound_dev_if && sk_saddr_any(sock->sk))
> + udp_tunnel_update_gro_lookup(net, sock->sk, true);
> }
> EXPORT_SYMBOL_GPL(setup_udp_tunnel_sock);
>
> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> index 3a0d6c5a8286b..3087022d18a55 100644
> --- a/net/ipv6/udp.c
> +++ b/net/ipv6/udp.c
> @@ -46,6 +46,7 @@
> #include <net/tcp_states.h>
> #include <net/ip6_checksum.h>
> #include <net/ip6_tunnel.h>
> +#include <net/udp_tunnel.h>
> #include <net/xfrm.h>
> #include <net/inet_hashtables.h>
> #include <net/inet6_hashtables.h>
> @@ -1824,6 +1825,7 @@ void udpv6_destroy_sock(struct sock *sk)
> }
> if (udp_test_bit(ENCAP_ENABLED, sk)) {
> static_branch_dec(&udpv6_encap_needed_key);
In ipv4, you removed the static_branch_dec(&udp_encap_needed_key);
> + udp_tunnel_cleanup_gro(sk);
> udp_encap_disable();
> }
> }
> diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
> index 404212dfc99ab..d8445ac1b2e43 100644
> --- a/net/ipv6/udp_offload.c
> +++ b/net/ipv6/udp_offload.c
> @@ -118,8 +118,13 @@ static struct sock *udp6_gro_lookup_skb(struct sk_buff *skb, __be16 sport,
> {
> const struct ipv6hdr *iph = skb_gro_network_header(skb);
> struct net *net = dev_net_rcu(skb->dev);
> + struct sock *sk;
> int iif, sdif;
>
> + sk = udp_tunnel_sk(net, true);
> + if (sk && dport == htons(sk->sk_num))
> + return sk;
> +
> inet6_get_iif_sdif(skb, &iif, &sdif);
>
> return __udp6_lib_lookup(net, &iph->saddr, sport,
> --
> 2.48.1
>
Powered by blists - more mailing lists