Netdev Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v2] ipvs: optimize tunnel dumps for icmp errors
@ 2020-03-15 13:25 Haishuang Yan
  2020-03-18 11:36 ` Julian Anastasov
  0 siblings, 1 reply; 4+ messages in thread
From: Haishuang Yan @ 2020-03-15 13:25 UTC (permalink / raw)
  To: Simon Horman, Julian Anastasov, Pablo Neira Ayuso
  Cc: netdev, lvs-devel, netfilter-devel, linux-kernel, Haishuang Yan

After strip GRE/UDP tunnel header for icmp errors, it's better to show
"GRE/UDP" instead of "IPIP" in debug message.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
---
v2: Fix wrong proto message
---
 net/netfilter/ipvs/ip_vs_core.c | 46 +++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 20 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 512259f..d2ac530 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1661,8 +1661,9 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 	struct ip_vs_protocol *pp;
 	struct ip_vs_proto_data *pd;
 	unsigned int offset, offset2, ihl, verdict;
-	bool ipip, new_cp = false;
+	bool tunnel, new_cp = false;
 	union nf_inet_addr *raddr;
+	char *outer_proto;
 
 	*related = 1;
 
@@ -1703,8 +1704,8 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		return NF_ACCEPT; /* The packet looks wrong, ignore */
 	raddr = (union nf_inet_addr *)&cih->daddr;
 
-	/* Special case for errors for IPIP packets */
-	ipip = false;
+	/* Special case for errors for IPIP/UDP/GRE tunnel packets */
+	tunnel = false;
 	if (cih->protocol == IPPROTO_IPIP) {
 		struct ip_vs_dest *dest;
 
@@ -1721,7 +1722,8 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
 		if (cih == NULL)
 			return NF_ACCEPT; /* The packet looks wrong, ignore */
-		ipip = true;
+		tunnel = true;
+		outer_proto = "IPIP";
 	} else if ((cih->protocol == IPPROTO_UDP ||	/* Can be UDP encap */
 		    cih->protocol == IPPROTO_GRE) &&	/* Can be GRE encap */
 		   /* Error for our tunnel must arrive at LOCAL_IN */
@@ -1729,16 +1731,19 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		__u8 iproto;
 		int ulen;
 
-		/* Non-first fragment has no UDP header */
+		/* Non-first fragment has no UDP/GRE header */
 		if (unlikely(cih->frag_off & htons(IP_OFFSET)))
 			return NF_ACCEPT;
 		offset2 = offset + cih->ihl * 4;
-		if (cih->protocol == IPPROTO_UDP)
+		if (cih->protocol == IPPROTO_UDP) {
 			ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,
 					      raddr, &iproto);
-		else
+			outer_proto = "UDP";
+		} else {
 			ulen = ipvs_gre_decap(ipvs, skb, offset2, AF_INET,
 					      raddr, &iproto);
+			outer_proto = "GRE";
+		}
 		if (ulen > 0) {
 			/* Skip IP and UDP/GRE tunnel headers */
 			offset = offset2 + ulen;
@@ -1747,7 +1752,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 						 &_ciph);
 			if (cih && cih->version == 4 && cih->ihl >= 5 &&
 			    iproto == IPPROTO_IPIP)
-				ipip = true;
+				tunnel = true;
 			else
 				return NF_ACCEPT;
 		}
@@ -1767,11 +1772,11 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		      "Checking incoming ICMP for");
 
 	offset2 = offset;
-	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !ipip, &ciph);
+	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !tunnel, &ciph);
 	offset = ciph.len;
 
 	/* The embedded headers contain source and dest in reverse order.
-	 * For IPIP this is error for request, not for reply.
+	 * For IPIP/UDP/GRE tunnel this is error for request, not for reply.
 	 */
 	cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
 			     ipvs, AF_INET, skb, &ciph);
@@ -1779,7 +1784,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 	if (!cp) {
 		int v;
 
-		if (ipip || !sysctl_schedule_icmp(ipvs))
+		if (tunnel || !sysctl_schedule_icmp(ipvs))
 			return NF_ACCEPT;
 
 		if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
@@ -1797,7 +1802,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		goto out;
 	}
 
-	if (ipip) {
+	if (tunnel) {
 		__be32 info = ic->un.gateway;
 		__u8 type = ic->type;
 		__u8 code = ic->code;
@@ -1809,17 +1814,18 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 			u32 mtu = ntohs(ic->un.frag.mtu);
 			__be16 frag_off = cih->frag_off;
 
-			/* Strip outer IP and ICMP, go to IPIP header */
+			/* Strip outer IP and ICMP, go to IPIP/UDP/GRE header */
 			if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
-				goto ignore_ipip;
+				goto ignore_tunnel;
 			offset2 -= ihl + sizeof(_icmph);
 			skb_reset_network_header(skb);
-			IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
-				&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);
+			IP_VS_DBG(12, "ICMP for %s %pI4->%pI4: mtu=%u\n",
+				  outer_proto, &ip_hdr(skb)->saddr,
+				  &ip_hdr(skb)->daddr, mtu);
 			ipv4_update_pmtu(skb, ipvs->net, mtu, 0, 0);
 			/* Client uses PMTUD? */
 			if (!(frag_off & htons(IP_DF)))
-				goto ignore_ipip;
+				goto ignore_tunnel;
 			/* Prefer the resulting PMTU */
 			if (dest) {
 				struct ip_vs_dest_dst *dest_dst;
@@ -1832,11 +1838,11 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 				mtu -= sizeof(struct iphdr);
 			info = htonl(mtu);
 		}
-		/* Strip outer IP, ICMP and IPIP, go to IP header of
+		/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
 		 * original request.
 		 */
 		if (pskb_pull(skb, offset2) == NULL)
-			goto ignore_ipip;
+			goto ignore_tunnel;
 		skb_reset_network_header(skb);
 		IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
 			&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
@@ -1845,7 +1851,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
 		/* ICMP can be shorter but anyways, account it */
 		ip_vs_out_stats(cp, skb);
 
-ignore_ipip:
+ignore_tunnel:
 		consume_skb(skb);
 		verdict = NF_STOLEN;
 		goto out;
-- 
1.8.3.1




^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH v2] ipvs: optimize tunnel dumps for icmp errors
  2020-03-15 13:25 [PATCH v2] ipvs: optimize tunnel dumps for icmp errors Haishuang Yan
@ 2020-03-18 11:36 ` Julian Anastasov
  2020-03-26 14:02   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 4+ messages in thread
From: Julian Anastasov @ 2020-03-18 11:36 UTC (permalink / raw)
  To: Haishuang Yan
  Cc: Simon Horman, Pablo Neira Ayuso, netdev, lvs-devel,
	netfilter-devel, linux-kernel


	Hello,

On Sun, 15 Mar 2020, Haishuang Yan wrote:

> After strip GRE/UDP tunnel header for icmp errors, it's better to show
> "GRE/UDP" instead of "IPIP" in debug message.
> 
> Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

	Looks good to me, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

	Simon, this is for -next kernels...

> ---
> v2: Fix wrong proto message
> ---
>  net/netfilter/ipvs/ip_vs_core.c | 46 +++++++++++++++++++++++------------------
>  1 file changed, 26 insertions(+), 20 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index 512259f..d2ac530 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -1661,8 +1661,9 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  	struct ip_vs_protocol *pp;
>  	struct ip_vs_proto_data *pd;
>  	unsigned int offset, offset2, ihl, verdict;
> -	bool ipip, new_cp = false;
> +	bool tunnel, new_cp = false;
>  	union nf_inet_addr *raddr;
> +	char *outer_proto;
>  
>  	*related = 1;
>  
> @@ -1703,8 +1704,8 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		return NF_ACCEPT; /* The packet looks wrong, ignore */
>  	raddr = (union nf_inet_addr *)&cih->daddr;
>  
> -	/* Special case for errors for IPIP packets */
> -	ipip = false;
> +	/* Special case for errors for IPIP/UDP/GRE tunnel packets */
> +	tunnel = false;
>  	if (cih->protocol == IPPROTO_IPIP) {
>  		struct ip_vs_dest *dest;
>  
> @@ -1721,7 +1722,8 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
>  		if (cih == NULL)
>  			return NF_ACCEPT; /* The packet looks wrong, ignore */
> -		ipip = true;
> +		tunnel = true;
> +		outer_proto = "IPIP";
>  	} else if ((cih->protocol == IPPROTO_UDP ||	/* Can be UDP encap */
>  		    cih->protocol == IPPROTO_GRE) &&	/* Can be GRE encap */
>  		   /* Error for our tunnel must arrive at LOCAL_IN */
> @@ -1729,16 +1731,19 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		__u8 iproto;
>  		int ulen;
>  
> -		/* Non-first fragment has no UDP header */
> +		/* Non-first fragment has no UDP/GRE header */
>  		if (unlikely(cih->frag_off & htons(IP_OFFSET)))
>  			return NF_ACCEPT;
>  		offset2 = offset + cih->ihl * 4;
> -		if (cih->protocol == IPPROTO_UDP)
> +		if (cih->protocol == IPPROTO_UDP) {
>  			ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,
>  					      raddr, &iproto);
> -		else
> +			outer_proto = "UDP";
> +		} else {
>  			ulen = ipvs_gre_decap(ipvs, skb, offset2, AF_INET,
>  					      raddr, &iproto);
> +			outer_proto = "GRE";
> +		}
>  		if (ulen > 0) {
>  			/* Skip IP and UDP/GRE tunnel headers */
>  			offset = offset2 + ulen;
> @@ -1747,7 +1752,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  						 &_ciph);
>  			if (cih && cih->version == 4 && cih->ihl >= 5 &&
>  			    iproto == IPPROTO_IPIP)
> -				ipip = true;
> +				tunnel = true;
>  			else
>  				return NF_ACCEPT;
>  		}
> @@ -1767,11 +1772,11 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		      "Checking incoming ICMP for");
>  
>  	offset2 = offset;
> -	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !ipip, &ciph);
> +	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !tunnel, &ciph);
>  	offset = ciph.len;
>  
>  	/* The embedded headers contain source and dest in reverse order.
> -	 * For IPIP this is error for request, not for reply.
> +	 * For IPIP/UDP/GRE tunnel this is error for request, not for reply.
>  	 */
>  	cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
>  			     ipvs, AF_INET, skb, &ciph);
> @@ -1779,7 +1784,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  	if (!cp) {
>  		int v;
>  
> -		if (ipip || !sysctl_schedule_icmp(ipvs))
> +		if (tunnel || !sysctl_schedule_icmp(ipvs))
>  			return NF_ACCEPT;
>  
>  		if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
> @@ -1797,7 +1802,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		goto out;
>  	}
>  
> -	if (ipip) {
> +	if (tunnel) {
>  		__be32 info = ic->un.gateway;
>  		__u8 type = ic->type;
>  		__u8 code = ic->code;
> @@ -1809,17 +1814,18 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  			u32 mtu = ntohs(ic->un.frag.mtu);
>  			__be16 frag_off = cih->frag_off;
>  
> -			/* Strip outer IP and ICMP, go to IPIP header */
> +			/* Strip outer IP and ICMP, go to IPIP/UDP/GRE header */
>  			if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
> -				goto ignore_ipip;
> +				goto ignore_tunnel;
>  			offset2 -= ihl + sizeof(_icmph);
>  			skb_reset_network_header(skb);
> -			IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
> -				&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);
> +			IP_VS_DBG(12, "ICMP for %s %pI4->%pI4: mtu=%u\n",
> +				  outer_proto, &ip_hdr(skb)->saddr,
> +				  &ip_hdr(skb)->daddr, mtu);
>  			ipv4_update_pmtu(skb, ipvs->net, mtu, 0, 0);
>  			/* Client uses PMTUD? */
>  			if (!(frag_off & htons(IP_DF)))
> -				goto ignore_ipip;
> +				goto ignore_tunnel;
>  			/* Prefer the resulting PMTU */
>  			if (dest) {
>  				struct ip_vs_dest_dst *dest_dst;
> @@ -1832,11 +1838,11 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  				mtu -= sizeof(struct iphdr);
>  			info = htonl(mtu);
>  		}
> -		/* Strip outer IP, ICMP and IPIP, go to IP header of
> +		/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
>  		 * original request.
>  		 */
>  		if (pskb_pull(skb, offset2) == NULL)
> -			goto ignore_ipip;
> +			goto ignore_tunnel;
>  		skb_reset_network_header(skb);
>  		IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
>  			&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
> @@ -1845,7 +1851,7 @@ static int ipvs_gre_decap(struct netns_ipvs *ipvs, struct sk_buff *skb,
>  		/* ICMP can be shorter but anyways, account it */
>  		ip_vs_out_stats(cp, skb);
>  
> -ignore_ipip:
> +ignore_tunnel:
>  		consume_skb(skb);
>  		verdict = NF_STOLEN;
>  		goto out;
> -- 
> 1.8.3.1

Regards

--
Julian Anastasov <ja@ssi.bg>

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH v2] ipvs: optimize tunnel dumps for icmp errors
  2020-03-18 11:36 ` Julian Anastasov
@ 2020-03-26 14:02   ` Pablo Neira Ayuso
  2020-04-01 13:03     ` Simon Horman
  0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-26 14:02 UTC (permalink / raw)
  To: Julian Anastasov
  Cc: Haishuang Yan, Simon Horman, netdev, lvs-devel, netfilter-devel,
	linux-kernel

On Wed, Mar 18, 2020 at 01:36:32PM +0200, Julian Anastasov wrote:
> 
> 	Hello,
> 
> On Sun, 15 Mar 2020, Haishuang Yan wrote:
> 
> > After strip GRE/UDP tunnel header for icmp errors, it's better to show
> > "GRE/UDP" instead of "IPIP" in debug message.
> > 
> > Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
> 
> 	Looks good to me, thanks!
> 
> Acked-by: Julian Anastasov <ja@ssi.bg>
> 
> 	Simon, this is for -next kernels...

Simon, if no objection, I'm going to include this in the next nf-next
pull request.

Thanks.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH v2] ipvs: optimize tunnel dumps for icmp errors
  2020-03-26 14:02   ` Pablo Neira Ayuso
@ 2020-04-01 13:03     ` Simon Horman
  0 siblings, 0 replies; 4+ messages in thread
From: Simon Horman @ 2020-04-01 13:03 UTC (permalink / raw)
  To: Pablo Neira Ayuso
  Cc: Julian Anastasov, Haishuang Yan, netdev, lvs-devel,
	netfilter-devel, linux-kernel

On Thu, Mar 26, 2020 at 03:02:29PM +0100, Pablo Neira Ayuso wrote:
> On Wed, Mar 18, 2020 at 01:36:32PM +0200, Julian Anastasov wrote:
> > 
> > 	Hello,
> > 
> > On Sun, 15 Mar 2020, Haishuang Yan wrote:
> > 
> > > After strip GRE/UDP tunnel header for icmp errors, it's better to show
> > > "GRE/UDP" instead of "IPIP" in debug message.
> > > 
> > > Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
> > 
> > 	Looks good to me, thanks!
> > 
> > Acked-by: Julian Anastasov <ja@ssi.bg>
> > 
> > 	Simon, this is for -next kernels...
> 
> Simon, if no objection, I'm going to include this in the next nf-next
> pull request.
> 

Sorry for being slow, I have no objections.

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-15 13:25 [PATCH v2] ipvs: optimize tunnel dumps for icmp errors Haishuang Yan
2020-03-18 11:36 ` Julian Anastasov
2020-03-26 14:02   ` Pablo Neira Ayuso
2020-04-01 13:03     ` Simon Horman

Netdev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git
	git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \
		netdev@vger.kernel.org
	public-inbox-index netdev

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netdev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git