bpf, vxlan, geneve, gre: fix usage of dst_cache on xmit

The assumptions from commit 0c1d70af924b ("net: use dst_cache for vxlan device"), 468dfffcd762 ("geneve: add dst caching support") and 3c1cb4d2604c ("net/ipv4: add dst cache support for gre lwtunnels") on dst_cache usage when ip_tunnel_info is used is unfortunately not always valid as assumed. While it seems correct for ip_tunnel_info front-ends such as OVS, eBPF however can fill in ip_tunnel_info for consumers like vxlan, geneve or gre with different remote dsts, tos, etc, therefore they cannot be assumed as packet independent. Right now vxlan, geneve, gre would cache the dst for eBPF and every packet would reuse the same entry that was first created on the initial route lookup. eBPF doesn't store/cache the ip_tunnel_info, so each skb may have a different one. Fix it by adding a flag that checks the ip_tunnel_info. Also the !tos test in vxlan needs to be handeled differently in this context as it is currently inferred from ip_tunnel_info as well if present. ip_tunnel_dst_cache_usable() helper is added for the three tunnel cases, which checks if we can use dst cache.

Daniel Borkmann committed 10 years ago

Commit db3c6131 parent 14ca0755 files · +36 −21Browse files

Unified · Split

5 files

drivers/net/geneve.c +2 −4
drivers/net/vxlan.c +12 −12
include/net/ip_tunnels.h +15 −0
net/core/filter.c +1 −1
net/ipv4/ip_gre.c +6 −4

drivers/net/geneve.c+2−4

@@ -775,10 +775,10 @@ static struct rtable geneve_get_v4_rt(struct sk_buff skb, · 774 unmodified lines
775	775	struct flowi4 *fl4,
776	776	struct ip_tunnel_info *info)
777	777	{
	778	+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
778	779	struct geneve_dev *geneve = netdev_priv(dev);
779	780	struct dst_cache *dst_cache;
780	781	struct rtable *rt = NULL;
781		− bool use_cache = true;
782	782	__u8 tos;
783	783
784	784	memset(fl4, 0, sizeof(*fl4));
@@ -804,7 +804,6 @@ static struct rtable geneve_get_v4_rt(struct sk_buff skb, · 19 unmodified lines
804	804	dst_cache = &geneve->dst_cache;
805	805	}
806	806
807		− use_cache = use_cache && !skb->mark;
808	807	if (use_cache) {
809	808	rt = dst_cache_get_ip4(dst_cache, &fl4->saddr);
810	809	if (rt)
@@ -832,11 +831,11 @@ static struct dst_entry geneve_get_v6_dst(struct sk_buff skb, · 21 unmodified lines
832	831	struct flowi6 *fl6,
833	832	struct ip_tunnel_info *info)
834	833	{
	834	+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
835	835	struct geneve_dev *geneve = netdev_priv(dev);
836	836	struct geneve_sock *gs6 = geneve->sock6;
837	837	struct dst_entry *dst = NULL;
838	838	struct dst_cache *dst_cache;
839		− bool use_cache = true;
840	839	__u8 prio;
841	840
842	841	memset(fl6, 0, sizeof(*fl6));
@@ -862,7 +861,6 @@ static struct dst_entry geneve_get_v6_dst(struct sk_buff skb, · 19 unmodified lines
862	861	dst_cache = &geneve->dst_cache;
863	862	}
864	863
865		− use_cache = use_cache && !skb->mark;
866	864	if (use_cache) {
867	865	dst = dst_cache_get_ip6(dst_cache, &fl6->saddr);
868	866	if (dst)

drivers/net/vxlan.c+12−12

@@ -1756,17 +1756,15 @@ static struct rtable vxlan_get_route(struct vxlan_dev vxlan, · 1755 unmodified lines
1756	1756	struct sk_buff *skb, int oif, u8 tos,
1757	1757	__be32 daddr, __be32 *saddr,
1758	1758	struct dst_cache *dst_cache,
1759		− struct ip_tunnel_info *info)
	1759	+ const struct ip_tunnel_info *info)
1760	1760	{
	1761	+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
1761	1762	struct rtable *rt = NULL;
1762		− bool use_cache = false;
1763	1763	struct flowi4 fl4;
1764	1764
1765		− /* when the ip_tunnel_info is availble, the tos used for lookup is
1766		− * packet independent, so we can use the cache
1767		− */
1768		− if (!skb->mark && (!tos \|\| info)) {
1769		− use_cache = true;
	1765	+ if (tos && !info)
	1766	+ use_cache = false;
	1767	+ if (use_cache) {
1770	1768	rt = dst_cache_get_ip4(dst_cache, saddr);
1771	1769	if (rt)
1772	1770	return rt;
@@ -1794,13 +1792,15 @@ static struct dst_entry vxlan6_get_route(struct vxlan_dev vxlan, · 21 unmodified lines
1794	1792	struct sk_buff *skb, int oif,
1795	1793	const struct in6_addr *daddr,
1796	1794	struct in6_addr *saddr,
1797		− struct dst_cache *dst_cache)
	1795	+ struct dst_cache *dst_cache,
	1796	+ const struct ip_tunnel_info *info)
1798	1797	{
	1798	+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
1799	1799	struct dst_entry *ndst;
1800	1800	struct flowi6 fl6;
1801	1801	int err;
1802	1802
1803		− if (!skb->mark) {
	1803	+ if (use_cache) {
1804	1804	ndst = dst_cache_get_ip6(dst_cache, saddr);
1805	1805	if (ndst)
1806	1806	return ndst;
@@ -1820,7 +1820,7 @@ static struct dst_entry vxlan6_get_route(struct vxlan_dev vxlan, · 13 unmodified lines
1820	1820	return ERR_PTR(err);
1821	1821
1822	1822	*saddr = fl6.saddr;
1823		− if (!skb->mark)
	1823	+ if (use_cache)
1824	1824	dst_cache_set_ip6(dst_cache, ndst, saddr);
1825	1825	return ndst;
1826	1826	}
@@ -2018,7 +2018,7 @@ static void vxlan_xmit_one(struct sk_buff skb, struct net_device dev, · 191 unmodified lines
2018	2018	ndst = vxlan6_get_route(vxlan, skb,
2019	2019	rdst ? rdst->remote_ifindex : 0,
2020	2020	&dst->sin6.sin6_addr, &saddr,
2021		− dst_cache);
	2021	+ dst_cache, info);
2022	2022	if (IS_ERR(ndst)) {
2023	2023	netdev_dbg(dev, "no route to %pI6\n",
2024	2024	&dst->sin6.sin6_addr);
@@ -2387,7 +2387,7 @@ static int vxlan_fill_metadata_dst(struct net_device dev, struct sk_buff skb) · 362 unmodified lines
2387	2387	return -EINVAL;
2388	2388	ndst = vxlan6_get_route(vxlan, skb, 0,
2389	2389	&info->key.u.ipv6.dst,
2390		− &info->key.u.ipv6.src, NULL);
	2390	+ &info->key.u.ipv6.src, NULL, info);
2391	2391	if (IS_ERR(ndst))
2392	2392	return PTR_ERR(ndst);
2393	2393	dst_release(ndst);

include/net/ip_tunnels.h+15−0

@@ -140,6 +140,7 @@ struct ip_tunnel { · 139 unmodified lines
140	140	#define TUNNEL_CRIT_OPT __cpu_to_be16(0x0400)
141	141	#define TUNNEL_GENEVE_OPT __cpu_to_be16(0x0800)
142	142	#define TUNNEL_VXLAN_OPT __cpu_to_be16(0x1000)
	143	+#define TUNNEL_NOCACHE __cpu_to_be16(0x2000)
143	144
144	145	#define TUNNEL_OPTIONS_PRESENT (TUNNEL_GENEVE_OPT \| TUNNEL_VXLAN_OPT)
145	146
@@ -206,6 +207,20 @@ static inline void ip_tunnel_key_init(struct ip_tunnel_key *key, · 60 unmodified lines
206	207	0, sizeof(*key) - IP_TUNNEL_KEY_SIZE);
207	208	}
208	209
	210	+static inline bool
	211	+ip_tunnel_dst_cache_usable(const struct sk_buff *skb,
	212	+ const struct ip_tunnel_info *info)
	213	+{
	214	+ if (skb->mark)
	215	+ return false;
	216	+ if (!info)
	217	+ return true;
	218	+ if (info->key.tun_flags & TUNNEL_NOCACHE)
	219	+ return false;
	220	+
	221	+ return true;
	222	+}
	223	+
209	224	static inline unsigned short ip_tunnel_info_af(const struct ip_tunnel_info
210	225	*tun_info)
211	226	{

net/core/filter.c+1−1

@@ -1870,7 +1870,7 @@ static u64 bpf_skb_set_tunnel_key(u64 r1, u64 r2, u64 size, u64 flags, u64 r5) · 1869 unmodified lines
1870	1870	info = &md->u.tun_info;
1871	1871	info->mode = IP_TUNNEL_INFO_TX;
1872	1872
1873		− info->key.tun_flags = TUNNEL_KEY \| TUNNEL_CSUM;
	1873	+ info->key.tun_flags = TUNNEL_KEY \| TUNNEL_CSUM \| TUNNEL_NOCACHE;
1874	1874	if (flags & BPF_F_DONT_FRAGMENT)
1875	1875	info->key.tun_flags \|= TUNNEL_DONT_FRAGMENT;
1876	1876

net/ipv4/ip_gre.c+6−4

@@ -527,11 +527,12 @@ static void gre_fb_xmit(struct sk_buff skb, struct net_device dev) · 526 unmodified lines
527	527	{
528	528	struct ip_tunnel_info *tun_info;
529	529	const struct ip_tunnel_key *key;
	530	+ struct rtable *rt = NULL;
530	531	struct flowi4 fl;
531		− struct rtable *rt;
532	532	int min_headroom;
533	533	int tunnel_hlen;
534	534	__be16 df, flags;
	535	+ bool use_cache;
535	536	int err;
536	537
537	538	tun_info = skb_tunnel_info(skb);
@@ -540,13 +541,14 @@ static void gre_fb_xmit(struct sk_buff skb, struct net_device dev) · 2 unmodified lines
540	541	goto err_free_skb;
541	542
542	543	key = &tun_info->key;
543		− rt = !skb->mark ? dst_cache_get_ip4(&tun_info->dst_cache, &fl.saddr) :
544		− NULL;
	544	+ use_cache = ip_tunnel_dst_cache_usable(skb, tun_info);
	545	+ if (use_cache)
	546	+ rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl.saddr);
545	547	if (!rt) {
546	548	rt = gre_get_rt(skb, dev, &fl, key);
547	549	if (IS_ERR(rt))
548	550	goto err_free_skb;
549		− if (!skb->mark)
	551	+ if (use_cache)
550	552	dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst,
551	553	fl.saddr);
552	554	}

bpf, vxlan, geneve, gre: fix usage of dst_cache on xmit

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code