Kernel generates mapping change message, XFRM_MSG_MAPPING, when a source port chage is detected on a input state with UDP encapsulation set. Kernel generates a message for each IPsec packet with new source port. For a high speed flow per packet mapping change message can be excessive, and can overload the user space listener. Introduce rate limiting for XFRM_MSG_MAPPING message to the user space. The rate limiting is configurable via netlink, when adding a new SA or updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds. v1->v2 change: update xfrm_sa_len() v2->v3 changes: use u32 insted unsigned long to reduce size of struct xfrm_state fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com> accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -313,6 +313,7 @@ enum xfrm_attr_type_t { · 312 unmodified lines | |||
| 313 | XFRMA_SET_MARK, /* __u32 */ | 313 | XFRMA_SET_MARK, /* __u32 */ |
| 314 | XFRMA_SET_MARK_MASK, /* __u32 */ | 314 | XFRMA_SET_MARK_MASK, /* __u32 */ |
| 315 | XFRMA_IF_ID, /* __u32 */ | 315 | XFRMA_IF_ID, /* __u32 */ |
| 316 | XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */ | ||
| 316 | __XFRMA_MAX | 317 | __XFRMA_MAX |
| 317 | 318 | ||
| 318 | #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ | 319 | #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ |