* pull request (net-next): ipsec-next 2013-09-26
@ 2013-09-26 8:58 Steffen Klassert
2013-09-26 8:58 ` [PATCH 1/2] xfrm: announce deleation of temporary SA Steffen Klassert
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Steffen Klassert @ 2013-09-26 8:58 UTC (permalink / raw
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
Two patches that are left from the last development cycle.
Manual merging of include/net/xfrm.h is needed. The conflict
can be solved as it is currently done in linux-next.
1) We announce the creation of temporary acquire state via an asyc event,
so the deletion should be annunced too. From Nicolas Dichtel.
2) The VTI tunnels do not real tunning, they just provide a routable
IPsec tunnel interface. So introduce and use xfrm_tunnel_notifier
instead of xfrm_tunnel for xfrm tunnel mode callback. From Fan Du.
Please pull or let me know if there are problems.
Thanks!
The following changes since commit b4de77ade3fc56e41b978b68d78a351dab28b74e:
ipip: potential race in ip_tunnel_init_net() (2013-08-25 18:39:59 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master
for you to fetch changes up to aba8269588301f7778bea811d6f7ec74c2e37279:
{ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback (2013-08-28 09:22:17 +0200)
----------------------------------------------------------------
Fan Du (1):
{ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback
Nicolas Dichtel (1):
xfrm: announce deleation of temporary SA
include/net/xfrm.h | 10 +++++--
net/ipv4/ip_vti.c | 67 +-----------------------------------------
net/ipv4/xfrm4_mode_tunnel.c | 16 +++++-----
net/xfrm/xfrm_state.c | 2 +-
4 files changed, 18 insertions(+), 77 deletions(-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 1/2] xfrm: announce deleation of temporary SA
2013-09-26 8:58 pull request (net-next): ipsec-next 2013-09-26 Steffen Klassert
@ 2013-09-26 8:58 ` Steffen Klassert
2013-09-26 8:58 ` [PATCH 2/2] {ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback Steffen Klassert
2013-09-30 19:12 ` pull request (net-next): ipsec-next 2013-09-26 David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Steffen Klassert @ 2013-09-26 8:58 UTC (permalink / raw
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Creation of temporary SA are announced by netlink, but there is no notification
for the deletion.
This patch fix this asymmetric situation.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 4f8ace8..3fd65b7 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -471,7 +471,7 @@ expired:
}
err = __xfrm_state_delete(x);
- if (!err && x->id.spi)
+ if (!err)
km_state_expired(x, 1, 0);
xfrm_audit_state_delete(x, err ? 0 : 1,
--
1.7.9.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] {ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback
2013-09-26 8:58 pull request (net-next): ipsec-next 2013-09-26 Steffen Klassert
2013-09-26 8:58 ` [PATCH 1/2] xfrm: announce deleation of temporary SA Steffen Klassert
@ 2013-09-26 8:58 ` Steffen Klassert
2013-09-30 19:12 ` pull request (net-next): ipsec-next 2013-09-26 David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Steffen Klassert @ 2013-09-26 8:58 UTC (permalink / raw
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
From: Fan Du <fan.du@windriver.com>
Some thoughts on IPv4 VTI implementation:
The connection between VTI receiving part and xfrm tunnel mode input process
is hardly a "xfrm_tunnel", xfrm_tunnel is used in places where, e.g ipip/sit
and xfrm4_tunnel, acts like a true "tunnel" device.
In addition, IMHO, VTI doesn't need vti_err to do something meaningful, as all
VTI needs is just a notifier to be called whenever xfrm_input ingress a packet
to update statistics.
A IPsec protected packet is first handled by protocol handlers, e.g AH/ESP,
to check packet authentication or encryption rightness. PMTU update is taken
care of in this stage by protocol error handler.
Then the packet is rearranged properly depending on whether it's transport
mode or tunnel mode packed by mode "input" handler. The VTI handler code
takes effects in this stage in tunnel mode only. So it neither need propagate
PMTU, as it has already been done if necessary, nor the VTI handler is
qualified as a xfrm_tunnel.
So this patch introduces xfrm_tunnel_notifier and meanwhile wipe out vti_err
code.
Signed-off-by: Fan Du <fan.du@windriver.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: David S. Miller <davem@davemloft.net>
Reviewed-by: Saurabh Mohan <saurabh.mohan@vyatta.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
include/net/xfrm.h | 10 +++++--
net/ipv4/ip_vti.c | 67 +-----------------------------------------
net/ipv4/xfrm4_mode_tunnel.c | 16 +++++-----
3 files changed, 17 insertions(+), 76 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 89d3d8a..c7afa6e 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1352,6 +1352,12 @@ struct xfrm_tunnel {
int priority;
};
+struct xfrm_tunnel_notifier {
+ int (*handler)(struct sk_buff *skb);
+ struct xfrm_tunnel_notifier __rcu *next;
+ int priority;
+};
+
struct xfrm6_tunnel {
int (*handler)(struct sk_buff *skb);
int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -1495,8 +1501,8 @@ extern int xfrm4_output(struct sk_buff *skb);
extern int xfrm4_output_finish(struct sk_buff *skb);
extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
-extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
-extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
+extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
+extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
extern int xfrm6_extract_header(struct sk_buff *skb);
extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e805e7b..91f69bc 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -49,70 +49,6 @@ static struct rtnl_link_ops vti_link_ops __read_mostly;
static int vti_net_id __read_mostly;
static int vti_tunnel_init(struct net_device *dev);
-static int vti_err(struct sk_buff *skb, u32 info)
-{
-
- /* All the routers (except for Linux) return only
- * 8 bytes of packet payload. It means, that precise relaying of
- * ICMP in the real Internet is absolutely infeasible.
- */
- struct net *net = dev_net(skb->dev);
- struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
- struct iphdr *iph = (struct iphdr *)skb->data;
- const int type = icmp_hdr(skb)->type;
- const int code = icmp_hdr(skb)->code;
- struct ip_tunnel *t;
- int err;
-
- switch (type) {
- default:
- case ICMP_PARAMETERPROB:
- return 0;
-
- case ICMP_DEST_UNREACH:
- switch (code) {
- case ICMP_SR_FAILED:
- case ICMP_PORT_UNREACH:
- /* Impossible event. */
- return 0;
- default:
- /* All others are translated to HOST_UNREACH. */
- break;
- }
- break;
- case ICMP_TIME_EXCEEDED:
- if (code != ICMP_EXC_TTL)
- return 0;
- break;
- }
-
- err = -ENOENT;
-
- t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
- iph->daddr, iph->saddr, 0);
- if (t == NULL)
- goto out;
-
- if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
- ipv4_update_pmtu(skb, dev_net(skb->dev), info,
- t->parms.link, 0, IPPROTO_IPIP, 0);
- err = 0;
- goto out;
- }
-
- err = 0;
- if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
- goto out;
-
- if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
- t->err_count++;
- else
- t->err_count = 1;
- t->err_time = jiffies;
-out:
- return err;
-}
-
/* We dont digest the packet therefore let the packet pass */
static int vti_rcv(struct sk_buff *skb)
{
@@ -296,9 +232,8 @@ static void __net_init vti_fb_tunnel_init(struct net_device *dev)
iph->ihl = 5;
}
-static struct xfrm_tunnel vti_handler __read_mostly = {
+static struct xfrm_tunnel_notifier vti_handler __read_mostly = {
.handler = vti_rcv,
- .err_handler = vti_err,
.priority = 1,
};
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index eb1dd4d..b82cde1 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -16,13 +16,13 @@
#include <net/xfrm.h>
/* Informational hook. The decap is still done here. */
-static struct xfrm_tunnel __rcu *rcv_notify_handlers __read_mostly;
+static struct xfrm_tunnel_notifier __rcu *rcv_notify_handlers __read_mostly;
static DEFINE_MUTEX(xfrm4_mode_tunnel_input_mutex);
-int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler)
+int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler)
{
- struct xfrm_tunnel __rcu **pprev;
- struct xfrm_tunnel *t;
+ struct xfrm_tunnel_notifier __rcu **pprev;
+ struct xfrm_tunnel_notifier *t;
int ret = -EEXIST;
int priority = handler->priority;
@@ -50,10 +50,10 @@ err:
}
EXPORT_SYMBOL_GPL(xfrm4_mode_tunnel_input_register);
-int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler)
+int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler)
{
- struct xfrm_tunnel __rcu **pprev;
- struct xfrm_tunnel *t;
+ struct xfrm_tunnel_notifier __rcu **pprev;
+ struct xfrm_tunnel_notifier *t;
int ret = -ENOENT;
mutex_lock(&xfrm4_mode_tunnel_input_mutex);
@@ -134,7 +134,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
{
- struct xfrm_tunnel *handler;
+ struct xfrm_tunnel_notifier *handler;
int err = -EINVAL;
if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: pull request (net-next): ipsec-next 2013-09-26
2013-09-26 8:58 pull request (net-next): ipsec-next 2013-09-26 Steffen Klassert
2013-09-26 8:58 ` [PATCH 1/2] xfrm: announce deleation of temporary SA Steffen Klassert
2013-09-26 8:58 ` [PATCH 2/2] {ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback Steffen Klassert
@ 2013-09-30 19:12 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-09-30 19:12 UTC (permalink / raw
To: steffen.klassert; +Cc: herbert, netdev
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Thu, 26 Sep 2013 10:58:41 +0200
> Two patches that are left from the last development cycle.
> Manual merging of include/net/xfrm.h is needed. The conflict
> can be solved as it is currently done in linux-next.
>
> 1) We announce the creation of temporary acquire state via an asyc event,
> so the deletion should be annunced too. From Nicolas Dichtel.
>
> 2) The VTI tunnels do not real tunning, they just provide a routable
> IPsec tunnel interface. So introduce and use xfrm_tunnel_notifier
> instead of xfrm_tunnel for xfrm tunnel mode callback. From Fan Du.
>
> Please pull or let me know if there are problems.
Pulled, thanks a lot!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-09-30 19:12 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-26 8:58 pull request (net-next): ipsec-next 2013-09-26 Steffen Klassert
2013-09-26 8:58 ` [PATCH 1/2] xfrm: announce deleation of temporary SA Steffen Klassert
2013-09-26 8:58 ` [PATCH 2/2] {ipv4,xfrm}: Introduce xfrm_tunnel_notifier for xfrm tunnel mode callback Steffen Klassert
2013-09-30 19:12 ` pull request (net-next): ipsec-next 2013-09-26 David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.