History

xfrm: rate limit SA mapping change message to user space

Kernel generates mapping change message, XFRM_MSG_MAPPING, when a source port chage is detected on a input state with UDP encapsulation set. Kernel generates a message for each IPsec packet with new source port. For a high speed flow per packet mapping change message can be excessive, and can overload the user space listener. Introduce rate limiting for XFRM_MSG_MAPPING message to the user space. The rate limiting is configurable via netlink, when adding a new SA or updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds. v1->v2 change: update xfrm_sa_len() v2->v3 changes: use u32 insted unsigned long to reduce size of struct xfrm_state fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com> accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present

Antony Antony committed 4 years ago

Commit 4e484b31 parent 23b6a6d5 files · +49 −4Browse files

Unified · Split

5 files
  1. include/net/xfrm.h +5 −0
  2. include/uapi/linux/xfrm.h +1 −0
  3. net/xfrm/xfrm_compat.c +4 −2
  4. net/xfrm/xfrm_state.c +22 −1
  5. net/xfrm/xfrm_user.c +17 −1
include/net/xfrm.h+5−0
@@ -200,6 +200,11 @@ struct xfrm_state { · 199 unmodified lines
200200 struct xfrm_algo_aead *aead;
201201 const char *geniv;
202202
203+ /* mapping change rate limiting */
204+ __be16 new_mapping_sport;
205+ u32 new_mapping; /* seconds */
206+ u32 mapping_maxage; /* seconds for input SA */
207+
203208 /* Data for encapsulator */
204209 struct xfrm_encap_tmpl *encap;
205210 struct sock __rcu *encap_sk;
include/uapi/linux/xfrm.h+1−0
@@ -313,6 +313,7 @@ enum xfrm_attr_type_t { · 312 unmodified lines
313313 XFRMA_SET_MARK, /* __u32 */
314314 XFRMA_SET_MARK_MASK, /* __u32 */
315315 XFRMA_IF_ID, /* __u32 */
316+ XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */
316317 __XFRMA_MAX
317318
318319 #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */
net/xfrm/xfrm_compat.c+4−2
@@ -127,6 +127,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { · 126 unmodified lines
127127 [XFRMA_SET_MARK] = { .type = NLA_U32 },
128128 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
129129 [XFRMA_IF_ID] = { .type = NLA_U32 },
130+ [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
130131 };
131132
132133 static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
@@ -274,9 +275,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src) · 141 unmodified lines
274275 case XFRMA_SET_MARK:
275276 case XFRMA_SET_MARK_MASK:
276277 case XFRMA_IF_ID:
278+ case XFRMA_MTIMER_THRESH:
277279 return xfrm_nla_cpy(dst, src, nla_len(src));
278280 default:
279− BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
281+ BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
280282 pr_warn_once("unsupported nla_type %d\n", src->nla_type);
281283 return -EOPNOTSUPP;
282284 }
@@ -431,7 +433,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla, · 148 unmodified lines
431433 int err;
432434
433435 if (type > XFRMA_MAX) {
434− BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
436+ BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
435437 NL_SET_ERR_MSG(extack, "Bad attribute");
436438 return -EOPNOTSUPP;
437439 }
net/xfrm/xfrm_state.c+22−1
@@ -1593,6 +1593,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, · 1592 unmodified lines
15931593 x->km.seq = orig->km.seq;
15941594 x->replay = orig->replay;
15951595 x->preplay = orig->preplay;
1596+ x->mapping_maxage = orig->mapping_maxage;
1597+ x->new_mapping = 0;
1598+ x->new_mapping_sport = 0;
15961599
15971600 return x;
15981601
@@ -2242,7 +2245,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) · 643 unmodified lines
22422245 }
22432246 EXPORT_SYMBOL(km_query);
22442247
2245−int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
2248+static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
22462249 {
22472250 int err = -EINVAL;
22482251 struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) · 8 unmodified lines
22572260 rcu_read_unlock();
22582261 return err;
22592262 }
2263+
2264+int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)
2265+{
2266+ int ret = 0;
2267+
2268+ if (x->mapping_maxage) {
2269+ if ((jiffies / HZ - x->new_mapping) > x->mapping_maxage ||
2270+ x->new_mapping_sport != sport) {
2271+ x->new_mapping_sport = sport;
2272+ x->new_mapping = jiffies / HZ;
2273+ ret = __km_new_mapping(x, ipaddr, sport);
2274+ }
2275+ } else {
2276+ ret = __km_new_mapping(x, ipaddr, sport);
2277+ }
2278+
2279+ return ret;
2280+}
22602281 EXPORT_SYMBOL(km_new_mapping);
22612282
22622283 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
net/xfrm/xfrm_user.c+17−1
@@ -282,6 +282,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, · 281 unmodified lines
282282
283283 err = 0;
284284
285+ if (attrs[XFRMA_MTIMER_THRESH])
286+ if (!attrs[XFRMA_ENCAP])
287+ err = -EINVAL;
288+
285289 out:
286290 return err;
287291 }
@@ -521,6 +525,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, · 233 unmodified lines
521525 struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
522526 struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
523527 struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
528+ struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
524529
525530 if (re) {
526531 struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +557,9 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, · 25 unmodified lines
552557
553558 if (rt)
554559 x->replay_maxdiff = nla_get_u32(rt);
560+
561+ if (mt)
562+ x->mapping_maxage = nla_get_u32(mt);
555563 }
556564
557565 static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1032,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x, · 466 unmodified lines
10241032 if (ret)
10251033 goto out;
10261034 }
1027− if (x->security)
1035+ if (x->security) {
10281036 ret = copy_sec_ctx(x->security, skb);
1037+ if (ret)
1038+ goto out;
1039+ }
1040+ if (x->mapping_maxage)
1041+ ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage);
10291042 out:
10301043 return ret;
10311044 }
@@ -3069,6 +3082,9 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) · 2037 unmodified lines
30693082 /* Must count x->lastused as it may become non-zero behind our back. */
30703083 l += nla_total_size_64bit(sizeof(u64));
30713084
3085+ if (x->mapping_maxage)
3086+ l += nla_total_size(sizeof(x->mapping_maxage));
3087+
30723088 return l;
30733089 }
30743090