* [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space
[not found] <YafsUMtO+zj/2xcC@moon.secunet.de>
@ 2021-12-16 22:37 ` Antony Antony
2021-12-17 7:32 ` Steffen Klassert
2021-12-17 16:46 ` [PATCH ipsec-next v2] " Antony Antony
2021-12-22 13:11 ` [PATCH ipsec-next v3] " Antony Antony
2 siblings, 1 reply; 7+ messages in thread
From: Antony Antony @ 2021-12-16 22:37 UTC (permalink / raw)
To: Steffen Klassert
Cc: Thomas Egerer, Herbert Xu, Antony Antony, David S. Miller,
Jakub Kicinski, netdev
Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port chage is detected on a input state with UDP
encapsulation. Kernel generates a message per each IPsec packet
with the new source port. For a high speed flow per packet mapping change
message can be very excessive, and can overload the user space listener.
Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH, in seconds.
Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
include/net/xfrm.h | 5 +++++
include/uapi/linux/xfrm.h | 1 +
net/xfrm/xfrm_state.c | 23 ++++++++++++++++++++++-
net/xfrm/xfrm_user.c | 12 +++++++++++-
4 files changed, 39 insertions(+), 2 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2308210793a0..f3842f6bf40d 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -232,6 +232,11 @@ struct xfrm_state {
u32 replay_maxage;
u32 replay_maxdiff;
+ /* mapping change rate limiting */
+ unsigned long new_mapping; /* jiffies */
+ unsigned long mapping_maxage; /* jiffies for input SA */
+ __be16 new_mapping_sport;
+
/* Replay detection notification timer */
struct timer_list rtimer;
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index b96c1ea7166d..d7ad5595d6cb 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -313,6 +313,7 @@ enum xfrm_attr_type_t {
XFRMA_SET_MARK, /* __u32 */
XFRMA_SET_MARK_MASK, /* __u32 */
XFRMA_IF_ID, /* __u32 */
+ XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */
__XFRMA_MAX
#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a2f4001221d1..5d28de6416f6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1593,6 +1593,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
x->km.seq = orig->km.seq;
x->replay = orig->replay;
x->preplay = orig->preplay;
+ x->mapping_maxage = orig->mapping_maxage;
+ x->new_mapping = 0;
+ x->new_mapping_sport = 0;
return x;
@@ -2242,7 +2245,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
}
EXPORT_SYMBOL(km_query);
-int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
{
int err = -EINVAL;
struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
rcu_read_unlock();
return err;
}
+
+int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+{
+ int ret = 0;
+
+ if (x->mapping_maxage) {
+ if ((jiffies - x->new_mapping) > x->mapping_maxage ||
+ x->new_mapping_sport != sport) {
+ x->new_mapping_sport = sport;
+ x->new_mapping = jiffies;
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+ } else {
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+
+ return ret;
+}
EXPORT_SYMBOL(km_new_mapping);
void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 03b66d154b2b..9f15d58eb29a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -521,6 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+ struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
if (re) {
struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +553,9 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
if (rt)
x->replay_maxdiff = nla_get_u32(rt);
+
+ if (mt)
+ x->mapping_maxage = nla_get_u32(mt);
}
static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1028,14 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
if (ret)
goto out;
}
- if (x->security)
+ if (x->security) {
ret = copy_sec_ctx(x->security, skb);
+ if (ret)
+ goto out;
+ }
+ if (x->mapping_maxage)
+ ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH,
+ (x->mapping_maxage / HZ));
out:
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space
2021-12-16 22:37 ` [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space Antony Antony
@ 2021-12-17 7:32 ` Steffen Klassert
0 siblings, 0 replies; 7+ messages in thread
From: Steffen Klassert @ 2021-12-17 7:32 UTC (permalink / raw)
To: Antony Antony
Cc: Thomas Egerer, Herbert Xu, David S. Miller, Jakub Kicinski, netdev
On Thu, Dec 16, 2021 at 11:37:06PM +0100, Antony Antony wrote:
> Kernel generates mapping change message, XFRM_MSG_MAPPING,
> when a source port chage is detected on a input state with UDP
> encapsulation. Kernel generates a message per each IPsec packet
> with the new source port. For a high speed flow per packet mapping change
> message can be very excessive, and can overload the user space listener.
>
> Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
>
> The rate limiting is configurable via netlink, when adding a new SA or
> updating it. Use the new attribute XFRMA_MTIMER_THRESH, in seconds.
>
> Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Antony Antony <antony.antony@secunet.com>
> ---
> include/net/xfrm.h | 5 +++++
> include/uapi/linux/xfrm.h | 1 +
> net/xfrm/xfrm_state.c | 23 ++++++++++++++++++++++-
> net/xfrm/xfrm_user.c | 12 +++++++++++-
> 4 files changed, 39 insertions(+), 2 deletions(-)
...
>
> static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
> @@ -1024,8 +1028,14 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
> if (ret)
> goto out;
> }
> - if (x->security)
> + if (x->security) {
> ret = copy_sec_ctx(x->security, skb);
> + if (ret)
> + goto out;
> + }
> + if (x->mapping_maxage)
> + ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH,
> + (x->mapping_maxage / HZ));
I think you need to update xfrm_sa_len() when you add data here.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH ipsec-next v2] xfrm: rate limit SA mapping change message to user space
[not found] <YafsUMtO+zj/2xcC@moon.secunet.de>
2021-12-16 22:37 ` [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space Antony Antony
@ 2021-12-17 16:46 ` Antony Antony
2021-12-21 20:55 ` kernel test robot
2021-12-22 13:11 ` [PATCH ipsec-next v3] " Antony Antony
2 siblings, 1 reply; 7+ messages in thread
From: Antony Antony @ 2021-12-17 16:46 UTC (permalink / raw)
To: Steffen Klassert
Cc: Thomas Egerer, Herbert Xu, Antony Antony, David S. Miller,
Jakub Kicinski, netdev
Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port change is detected on a input state with UDP
encapsulation set. Kernel generates a message for each IPsec packet
with new source port. For a high speed flow per packet mapping change
message can be excessive, and can overload the user space listener.
Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds.
v1->v2 change:
update xfrm_sa_len()
Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
include/net/xfrm.h | 5 +++++
include/uapi/linux/xfrm.h | 1 +
net/xfrm/xfrm_state.c | 23 ++++++++++++++++++++++-
net/xfrm/xfrm_user.c | 15 ++++++++++++++-
4 files changed, 42 insertions(+), 2 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2308210793a0..f3842f6bf40d 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -232,6 +232,11 @@ struct xfrm_state {
u32 replay_maxage;
u32 replay_maxdiff;
+ /* mapping change rate limiting */
+ unsigned long new_mapping; /* jiffies */
+ unsigned long mapping_maxage; /* jiffies for input SA */
+ __be16 new_mapping_sport;
+
/* Replay detection notification timer */
struct timer_list rtimer;
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index eda0426ec4c2..4e29d7851890 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -313,6 +313,7 @@ enum xfrm_attr_type_t {
XFRMA_SET_MARK, /* __u32 */
XFRMA_SET_MARK_MASK, /* __u32 */
XFRMA_IF_ID, /* __u32 */
+ XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */
__XFRMA_MAX
#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a2f4001221d1..5d28de6416f6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1593,6 +1593,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
x->km.seq = orig->km.seq;
x->replay = orig->replay;
x->preplay = orig->preplay;
+ x->mapping_maxage = orig->mapping_maxage;
+ x->new_mapping = 0;
+ x->new_mapping_sport = 0;
return x;
@@ -2242,7 +2245,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
}
EXPORT_SYMBOL(km_query);
-int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
{
int err = -EINVAL;
struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
rcu_read_unlock();
return err;
}
+
+int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+{
+ int ret = 0;
+
+ if (x->mapping_maxage) {
+ if ((jiffies - x->new_mapping) > x->mapping_maxage ||
+ x->new_mapping_sport != sport) {
+ x->new_mapping_sport = sport;
+ x->new_mapping = jiffies;
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+ } else {
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+
+ return ret;
+}
EXPORT_SYMBOL(km_new_mapping);
void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 7c36cc1f3d79..61c6615ea586 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -521,6 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+ struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
if (re) {
struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +553,9 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
if (rt)
x->replay_maxdiff = nla_get_u32(rt);
+
+ if (mt)
+ x->mapping_maxage = nla_get_u32(mt);
}
static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1028,14 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
if (ret)
goto out;
}
- if (x->security)
+ if (x->security) {
ret = copy_sec_ctx(x->security, skb);
+ if (ret)
+ goto out;
+ }
+ if (x->mapping_maxage)
+ ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH,
+ (x->mapping_maxage / HZ));
out:
return ret;
}
@@ -3069,6 +3079,9 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
/* Must count x->lastused as it may become non-zero behind our back. */
l += nla_total_size_64bit(sizeof(u64));
+ if (x->mapping_maxage)
+ l += nla_total_size(sizeof(x->mapping_maxage));
+
return l;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH ipsec-next v2] xfrm: rate limit SA mapping change message to user space
2021-12-17 16:46 ` [PATCH ipsec-next v2] " Antony Antony
@ 2021-12-21 20:55 ` kernel test robot
0 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2021-12-21 20:55 UTC (permalink / raw)
To: Antony Antony, Steffen Klassert
Cc: kbuild-all, Thomas Egerer, Herbert Xu, Antony Antony,
Jakub Kicinski, netdev
Hi Antony,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on klassert-ipsec-next/master]
[also build test ERROR on klassert-ipsec/master net-next/master net/master v5.16-rc6 next-20211221]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Antony-Antony/xfrm-rate-limit-SA-mapping-change-message-to-user-space/20211218-004825
base: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20211222/202112220439.Errml0C2-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/0deffb6fd76e1afc0a82880f4ab1b7a32517cd2e
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Antony-Antony/xfrm-rate-limit-SA-mapping-change-message-to-user-space/20211218-004825
git checkout 0deffb6fd76e1afc0a82880f4ab1b7a32517cd2e
# save the config file to linux build tree
mkdir build_dir
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
In file included from <command-line>:
In function 'xfrm_xlate32_attr',
inlined from 'xfrm_xlate32' at net/xfrm/xfrm_compat.c:571:9:
>> include/linux/compiler_types.h:335:38: error: call to '__compiletime_assert_1663' declared with attribute error: BUILD_BUG_ON failed: XFRMA_MAX != XFRMA_IF_ID
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:316:4: note: in definition of macro '__compiletime_assert'
316 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:335:2: note: in expansion of macro '_compiletime_assert'
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:2: note: in expansion of macro 'BUILD_BUG_ON_MSG'
50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
net/xfrm/xfrm_compat.c:434:3: note: in expansion of macro 'BUILD_BUG_ON'
434 | BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
| ^~~~~~~~~~~~
In function 'xfrm_xlate64_attr',
inlined from 'xfrm_xlate64' at net/xfrm/xfrm_compat.c:308:10,
inlined from 'xfrm_alloc_compat' at net/xfrm/xfrm_compat.c:338:8:
include/linux/compiler_types.h:335:38: error: call to '__compiletime_assert_1656' declared with attribute error: BUILD_BUG_ON failed: XFRMA_MAX != XFRMA_IF_ID
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:316:4: note: in definition of macro '__compiletime_assert'
316 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:335:2: note: in expansion of macro '_compiletime_assert'
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:2: note: in expansion of macro 'BUILD_BUG_ON_MSG'
50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
net/xfrm/xfrm_compat.c:279:3: note: in expansion of macro 'BUILD_BUG_ON'
279 | BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
| ^~~~~~~~~~~~
vim +/__compiletime_assert_1663 +335 include/linux/compiler_types.h
eb5c2d4b45e3d2d Will Deacon 2020-07-21 321
eb5c2d4b45e3d2d Will Deacon 2020-07-21 322 #define _compiletime_assert(condition, msg, prefix, suffix) \
eb5c2d4b45e3d2d Will Deacon 2020-07-21 323 __compiletime_assert(condition, msg, prefix, suffix)
eb5c2d4b45e3d2d Will Deacon 2020-07-21 324
eb5c2d4b45e3d2d Will Deacon 2020-07-21 325 /**
eb5c2d4b45e3d2d Will Deacon 2020-07-21 326 * compiletime_assert - break build and emit msg if condition is false
eb5c2d4b45e3d2d Will Deacon 2020-07-21 327 * @condition: a compile-time constant condition to check
eb5c2d4b45e3d2d Will Deacon 2020-07-21 328 * @msg: a message to emit if condition is false
eb5c2d4b45e3d2d Will Deacon 2020-07-21 329 *
eb5c2d4b45e3d2d Will Deacon 2020-07-21 330 * In tradition of POSIX assert, this macro will break the build if the
eb5c2d4b45e3d2d Will Deacon 2020-07-21 331 * supplied condition is *false*, emitting the supplied error message if the
eb5c2d4b45e3d2d Will Deacon 2020-07-21 332 * compiler has support to do so.
eb5c2d4b45e3d2d Will Deacon 2020-07-21 333 */
eb5c2d4b45e3d2d Will Deacon 2020-07-21 334 #define compiletime_assert(condition, msg) \
eb5c2d4b45e3d2d Will Deacon 2020-07-21 @335 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
eb5c2d4b45e3d2d Will Deacon 2020-07-21 336
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH ipsec-next v2] xfrm: rate limit SA mapping change message to user space
@ 2021-12-21 20:55 ` kernel test robot
0 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2021-12-21 20:55 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 5850 bytes --]
Hi Antony,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on klassert-ipsec-next/master]
[also build test ERROR on klassert-ipsec/master net-next/master net/master v5.16-rc6 next-20211221]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Antony-Antony/xfrm-rate-limit-SA-mapping-change-message-to-user-space/20211218-004825
base: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20211222/202112220439.Errml0C2-lkp(a)intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/0deffb6fd76e1afc0a82880f4ab1b7a32517cd2e
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Antony-Antony/xfrm-rate-limit-SA-mapping-change-message-to-user-space/20211218-004825
git checkout 0deffb6fd76e1afc0a82880f4ab1b7a32517cd2e
# save the config file to linux build tree
mkdir build_dir
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
In file included from <command-line>:
In function 'xfrm_xlate32_attr',
inlined from 'xfrm_xlate32' at net/xfrm/xfrm_compat.c:571:9:
>> include/linux/compiler_types.h:335:38: error: call to '__compiletime_assert_1663' declared with attribute error: BUILD_BUG_ON failed: XFRMA_MAX != XFRMA_IF_ID
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:316:4: note: in definition of macro '__compiletime_assert'
316 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:335:2: note: in expansion of macro '_compiletime_assert'
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:2: note: in expansion of macro 'BUILD_BUG_ON_MSG'
50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
net/xfrm/xfrm_compat.c:434:3: note: in expansion of macro 'BUILD_BUG_ON'
434 | BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
| ^~~~~~~~~~~~
In function 'xfrm_xlate64_attr',
inlined from 'xfrm_xlate64' at net/xfrm/xfrm_compat.c:308:10,
inlined from 'xfrm_alloc_compat' at net/xfrm/xfrm_compat.c:338:8:
include/linux/compiler_types.h:335:38: error: call to '__compiletime_assert_1656' declared with attribute error: BUILD_BUG_ON failed: XFRMA_MAX != XFRMA_IF_ID
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:316:4: note: in definition of macro '__compiletime_assert'
316 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:335:2: note: in expansion of macro '_compiletime_assert'
335 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:2: note: in expansion of macro 'BUILD_BUG_ON_MSG'
50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
net/xfrm/xfrm_compat.c:279:3: note: in expansion of macro 'BUILD_BUG_ON'
279 | BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
| ^~~~~~~~~~~~
vim +/__compiletime_assert_1663 +335 include/linux/compiler_types.h
eb5c2d4b45e3d2d Will Deacon 2020-07-21 321
eb5c2d4b45e3d2d Will Deacon 2020-07-21 322 #define _compiletime_assert(condition, msg, prefix, suffix) \
eb5c2d4b45e3d2d Will Deacon 2020-07-21 323 __compiletime_assert(condition, msg, prefix, suffix)
eb5c2d4b45e3d2d Will Deacon 2020-07-21 324
eb5c2d4b45e3d2d Will Deacon 2020-07-21 325 /**
eb5c2d4b45e3d2d Will Deacon 2020-07-21 326 * compiletime_assert - break build and emit msg if condition is false
eb5c2d4b45e3d2d Will Deacon 2020-07-21 327 * @condition: a compile-time constant condition to check
eb5c2d4b45e3d2d Will Deacon 2020-07-21 328 * @msg: a message to emit if condition is false
eb5c2d4b45e3d2d Will Deacon 2020-07-21 329 *
eb5c2d4b45e3d2d Will Deacon 2020-07-21 330 * In tradition of POSIX assert, this macro will break the build if the
eb5c2d4b45e3d2d Will Deacon 2020-07-21 331 * supplied condition is *false*, emitting the supplied error message if the
eb5c2d4b45e3d2d Will Deacon 2020-07-21 332 * compiler has support to do so.
eb5c2d4b45e3d2d Will Deacon 2020-07-21 333 */
eb5c2d4b45e3d2d Will Deacon 2020-07-21 334 #define compiletime_assert(condition, msg) \
eb5c2d4b45e3d2d Will Deacon 2020-07-21 @335 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
eb5c2d4b45e3d2d Will Deacon 2020-07-21 336
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH ipsec-next v3] xfrm: rate limit SA mapping change message to user space
[not found] <YafsUMtO+zj/2xcC@moon.secunet.de>
2021-12-16 22:37 ` [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space Antony Antony
2021-12-17 16:46 ` [PATCH ipsec-next v2] " Antony Antony
@ 2021-12-22 13:11 ` Antony Antony
2021-12-29 10:19 ` Steffen Klassert
2 siblings, 1 reply; 7+ messages in thread
From: Antony Antony @ 2021-12-22 13:11 UTC (permalink / raw)
To: Steffen Klassert
Cc: Thomas Egerer, Herbert Xu, Antony Antony, David S. Miller,
Jakub Kicinski, netdev
Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port chage is detected on a input state with UDP
encapsulation set. Kernel generates a message for each IPsec packet
with new source port. For a high speed flow per packet mapping change
message can be excessive, and can overload the user space listener.
Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds.
v1->v2 change:
update xfrm_sa_len()
v2->v3 changes:
use u32 insted unsigned long to reduce size of struct xfrm_state
fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com>
accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present
Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
include/net/xfrm.h | 5 +++++
include/uapi/linux/xfrm.h | 1 +
net/xfrm/xfrm_compat.c | 6 ++++--
net/xfrm/xfrm_state.c | 23 ++++++++++++++++++++++-
net/xfrm/xfrm_user.c | 18 +++++++++++++++++-
5 files changed, 49 insertions(+), 4 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2308210793a0..2589e4c0501b 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -200,6 +200,11 @@ struct xfrm_state {
struct xfrm_algo_aead *aead;
const char *geniv;
+ /* mapping change rate limiting */
+ __be16 new_mapping_sport;
+ u32 new_mapping; /* seconds */
+ u32 mapping_maxage; /* seconds for input SA */
+
/* Data for encapsulator */
struct xfrm_encap_tmpl *encap;
struct sock __rcu *encap_sk;
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index eda0426ec4c2..4e29d7851890 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -313,6 +313,7 @@ enum xfrm_attr_type_t {
XFRMA_SET_MARK, /* __u32 */
XFRMA_SET_MARK_MASK, /* __u32 */
XFRMA_IF_ID, /* __u32 */
+ XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */
__XFRMA_MAX
#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */
diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
index 2bf269390163..a0f62fa02e06 100644
--- a/net/xfrm/xfrm_compat.c
+++ b/net/xfrm/xfrm_compat.c
@@ -127,6 +127,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
[XFRMA_SET_MARK] = { .type = NLA_U32 },
[XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
[XFRMA_IF_ID] = { .type = NLA_U32 },
+ [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
};
static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
@@ -274,9 +275,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
case XFRMA_SET_MARK:
case XFRMA_SET_MARK_MASK:
case XFRMA_IF_ID:
+ case XFRMA_MTIMER_THRESH:
return xfrm_nla_cpy(dst, src, nla_len(src));
default:
- BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
+ BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
pr_warn_once("unsupported nla_type %d\n", src->nla_type);
return -EOPNOTSUPP;
}
@@ -431,7 +433,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
int err;
if (type > XFRMA_MAX) {
- BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
+ BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
NL_SET_ERR_MSG(extack, "Bad attribute");
return -EOPNOTSUPP;
}
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a2f4001221d1..78d51399a0f4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1593,6 +1593,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
x->km.seq = orig->km.seq;
x->replay = orig->replay;
x->preplay = orig->preplay;
+ x->mapping_maxage = orig->mapping_maxage;
+ x->new_mapping = 0;
+ x->new_mapping_sport = 0;
return x;
@@ -2242,7 +2245,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
}
EXPORT_SYMBOL(km_query);
-int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
{
int err = -EINVAL;
struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
rcu_read_unlock();
return err;
}
+
+int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+{
+ int ret = 0;
+
+ if (x->mapping_maxage) {
+ if ((jiffies / HZ - x->new_mapping) > x->mapping_maxage ||
+ x->new_mapping_sport != sport) {
+ x->new_mapping_sport = sport;
+ x->new_mapping = jiffies / HZ;
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+ } else {
+ ret = __km_new_mapping(x, ipaddr, sport);
+ }
+
+ return ret;
+}
EXPORT_SYMBOL(km_new_mapping);
void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 7c36cc1f3d79..130240680655 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -282,6 +282,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
err = 0;
+ if (attrs[XFRMA_MTIMER_THRESH])
+ if (!attrs[XFRMA_ENCAP])
+ err = -EINVAL;
+
out:
return err;
}
@@ -521,6 +525,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+ struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
if (re) {
struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +557,9 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
if (rt)
x->replay_maxdiff = nla_get_u32(rt);
+
+ if (mt)
+ x->mapping_maxage = nla_get_u32(mt);
}
static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1032,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
if (ret)
goto out;
}
- if (x->security)
+ if (x->security) {
ret = copy_sec_ctx(x->security, skb);
+ if (ret)
+ goto out;
+ }
+ if (x->mapping_maxage)
+ ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage);
out:
return ret;
}
@@ -3069,6 +3082,9 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
/* Must count x->lastused as it may become non-zero behind our back. */
l += nla_total_size_64bit(sizeof(u64));
+ if (x->mapping_maxage)
+ l += nla_total_size(sizeof(x->mapping_maxage));
+
return l;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH ipsec-next v3] xfrm: rate limit SA mapping change message to user space
2021-12-22 13:11 ` [PATCH ipsec-next v3] " Antony Antony
@ 2021-12-29 10:19 ` Steffen Klassert
0 siblings, 0 replies; 7+ messages in thread
From: Steffen Klassert @ 2021-12-29 10:19 UTC (permalink / raw)
To: Antony Antony
Cc: Thomas Egerer, Herbert Xu, David S. Miller, Jakub Kicinski, netdev
On Wed, Dec 22, 2021 at 02:11:18PM +0100, Antony Antony wrote:
> Kernel generates mapping change message, XFRM_MSG_MAPPING,
> when a source port chage is detected on a input state with UDP
> encapsulation set. Kernel generates a message for each IPsec packet
> with new source port. For a high speed flow per packet mapping change
> message can be excessive, and can overload the user space listener.
>
> Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
>
> The rate limiting is configurable via netlink, when adding a new SA or
> updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds.
>
> v1->v2 change:
> update xfrm_sa_len()
>
> v2->v3 changes:
> use u32 insted unsigned long to reduce size of struct xfrm_state
> fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com>
> accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present
>
> Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Antony Antony <antony.antony@secunet.com>
Applied, thanks a lot!
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-12-29 10:19 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <YafsUMtO+zj/2xcC@moon.secunet.de>
2021-12-16 22:37 ` [PATCH ipsec-next] xfrm: rate limit SA mapping change message to user space Antony Antony
2021-12-17 7:32 ` Steffen Klassert
2021-12-17 16:46 ` [PATCH ipsec-next v2] " Antony Antony
2021-12-21 20:55 ` kernel test robot
2021-12-21 20:55 ` kernel test robot
2021-12-22 13:11 ` [PATCH ipsec-next v3] " Antony Antony
2021-12-29 10:19 ` Steffen Klassert
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.