diff mbox series

[ipsec-next] xfrm: rate limit SA mapping change message to user space

Message ID 3453d9c8dccd74e43c8eef1ee261c85e7a3460db.1639693812.git.antony.antony@secunet.com (mailing list archive)
State Superseded
Delegated to: Netdev Maintainers
Headers show
Series [ipsec-next] xfrm: rate limit SA mapping change message to user space | expand

Checks

Context Check Description
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 5082 this patch: 5082
netdev/cc_maintainers success CCed 5 of 5 maintainers
netdev/build_clang fail Errors and warnings before: 879 this patch: 885
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn fail Errors and warnings before: 5234 this patch: 5018
netdev/checkpatch warning WARNING: line length of 87 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
netdev/tree_selection success Guessing tree name failed - patch did not apply

Commit Message

Antony Antony Dec. 16, 2021, 10:37 p.m. UTC 
Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port chage is detected on a input state with UDP
encapsulation. Kernel generates a message per each IPsec packet
with the new source port. For a high speed flow per packet mapping change
message can be very excessive, and can overload the user space listener.

Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.

The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH, in seconds.

Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
 include/net/xfrm.h        |  5 +++++
 include/uapi/linux/xfrm.h |  1 +
 net/xfrm/xfrm_state.c     | 23 ++++++++++++++++++++++-
 net/xfrm/xfrm_user.c      | 12 +++++++++++-
 4 files changed, 39 insertions(+), 2 deletions(-)

Comments

Steffen Klassert Dec. 17, 2021, 7:32 a.m. UTC | #1 
On Thu, Dec 16, 2021 at 11:37:06PM +0100, Antony Antony wrote:
> Kernel generates mapping change message, XFRM_MSG_MAPPING,
> when a source port chage is detected on a input state with UDP
> encapsulation. Kernel generates a message per each IPsec packet
> with the new source port. For a high speed flow per packet mapping change
> message can be very excessive, and can overload the user space listener.
> 
> Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
> 
> The rate limiting is configurable via netlink, when adding a new SA or
> updating it. Use the new attribute XFRMA_MTIMER_THRESH, in seconds.
> 
> Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
> Signed-off-by: Antony Antony <antony.antony@secunet.com>
> ---
>  include/net/xfrm.h        |  5 +++++
>  include/uapi/linux/xfrm.h |  1 +
>  net/xfrm/xfrm_state.c     | 23 ++++++++++++++++++++++-
>  net/xfrm/xfrm_user.c      | 12 +++++++++++-
>  4 files changed, 39 insertions(+), 2 deletions(-)

...

>  
>  static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
> @@ -1024,8 +1028,14 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
>  		if (ret)
>  			goto out;
>  	}
> -	if (x->security)
> +	if (x->security) {
>  		ret = copy_sec_ctx(x->security, skb);
> +		if (ret)
> +			goto out;
> +	}
> +	if (x->mapping_maxage)
> +		ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH,
> +				  (x->mapping_maxage / HZ));

I think you need to update xfrm_sa_len() when you add data here.
diff mbox series

Patch

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2308210793a0..f3842f6bf40d 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -232,6 +232,11 @@  struct xfrm_state {
 	u32			replay_maxage;
 	u32			replay_maxdiff;
 
+	/* mapping change rate limiting */
+	unsigned long new_mapping;	/* jiffies */
+	unsigned long mapping_maxage;	/* jiffies for input SA */
+	__be16 new_mapping_sport;
+
 	/* Replay detection notification timer */
 	struct timer_list	rtimer;
 
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index b96c1ea7166d..d7ad5595d6cb 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -313,6 +313,7 @@  enum xfrm_attr_type_t {
 	XFRMA_SET_MARK,		/* __u32 */
 	XFRMA_SET_MARK_MASK,	/* __u32 */
 	XFRMA_IF_ID,		/* __u32 */
+	XFRMA_MTIMER_THRESH,	/* __u32 in seconds for input SA */
 	__XFRMA_MAX
 
 #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK	/* Compatibility */
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a2f4001221d1..5d28de6416f6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1593,6 +1593,9 @@  static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
 	x->km.seq = orig->km.seq;
 	x->replay = orig->replay;
 	x->preplay = orig->preplay;
+	x->mapping_maxage = orig->mapping_maxage;
+	x->new_mapping = 0;
+	x->new_mapping_sport = 0;
 
 	return x;
 
@@ -2242,7 +2245,7 @@  int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 }
 EXPORT_SYMBOL(km_query);
 
-int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
 {
 	int err = -EINVAL;
 	struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@  int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
 	rcu_read_unlock();
 	return err;
 }
+
+int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
+{
+	int ret = 0;
+
+	if (x->mapping_maxage) {
+		if ((jiffies - x->new_mapping) > x->mapping_maxage ||
+		    x->new_mapping_sport != sport) {
+			x->new_mapping_sport = sport;
+			x->new_mapping = jiffies;
+			ret = __km_new_mapping(x, ipaddr, sport);
+		}
+	} else {
+		ret = __km_new_mapping(x, ipaddr, sport);
+	}
+
+	return ret;
+}
 EXPORT_SYMBOL(km_new_mapping);
 
 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 03b66d154b2b..9f15d58eb29a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -521,6 +521,7 @@  static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
 	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
 	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
 	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+	struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
 
 	if (re) {
 		struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +553,9 @@  static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
 
 	if (rt)
 		x->replay_maxdiff = nla_get_u32(rt);
+
+	if (mt)
+		x->mapping_maxage = nla_get_u32(mt);
 }
 
 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1028,14 @@  static int copy_to_user_state_extra(struct xfrm_state *x,
 		if (ret)
 			goto out;
 	}
-	if (x->security)
+	if (x->security) {
 		ret = copy_sec_ctx(x->security, skb);
+		if (ret)
+			goto out;
+	}
+	if (x->mapping_maxage)
+		ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH,
+				  (x->mapping_maxage / HZ));
 out:
 	return ret;
 }