Kernel generates mapping change message, XFRM_MSG_MAPPING, when a source port chage is detected on a input state with UDP encapsulation set. Kernel generates a message for each IPsec packet with new source port. For a high speed flow per packet mapping change message can be excessive, and can overload the user space listener. Introduce rate limiting for XFRM_MSG_MAPPING message to the user space. The rate limiting is configurable via netlink, when adding a new SA or updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds. v1->v2 change: update xfrm_sa_len() v2->v3 changes: use u32 insted unsigned long to reduce size of struct xfrm_state fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com> accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present
Showing the changes to include (2 of 5 files). Show all
Unified · Split
| @@ -200,6 +200,11 @@ struct xfrm_state { · 199 unmodified lines | |||
| 200 | struct xfrm_algo_aead *aead; | 200 | struct xfrm_algo_aead *aead; |
| 201 | const char *geniv; | 201 | const char *geniv; |
| 202 | 202 | ||
| 203 | /* mapping change rate limiting */ | ||
| 204 | __be16 new_mapping_sport; | ||
| 205 | u32 new_mapping; /* seconds */ | ||
| 206 | u32 mapping_maxage; /* seconds for input SA */ | ||
| 207 | |||
| 203 | /* Data for encapsulator */ | 208 | /* Data for encapsulator */ |
| 204 | struct xfrm_encap_tmpl *encap; | 209 | struct xfrm_encap_tmpl *encap; |
| 205 | struct sock __rcu *encap_sk; | 210 | struct sock __rcu *encap_sk; |
| @@ -313,6 +313,7 @@ enum xfrm_attr_type_t { · 312 unmodified lines | |||
| 313 | XFRMA_SET_MARK, /* __u32 */ | 313 | XFRMA_SET_MARK, /* __u32 */ |
| 314 | XFRMA_SET_MARK_MASK, /* __u32 */ | 314 | XFRMA_SET_MARK_MASK, /* __u32 */ |
| 315 | XFRMA_IF_ID, /* __u32 */ | 315 | XFRMA_IF_ID, /* __u32 */ |
| 316 | XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */ | ||
| 316 | __XFRMA_MAX | 317 | __XFRMA_MAX |
| 317 | 318 | ||
| 318 | #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ | 319 | #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ |