Commit 4e484b3e authored by Antony Antony's avatar Antony Antony Committed by Steffen Klassert
Browse files

xfrm: rate limit SA mapping change message to user space 



Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port chage is detected on a input state with UDP
encapsulation set.  Kernel generates a message for each IPsec packet
with new source port.  For a high speed flow per packet mapping change
message can be excessive, and can overload the user space listener.

Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.

The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds.

v1->v2 change:
	update xfrm_sa_len()

v2->v3 changes:
	use u32 insted unsigned long to reduce size of struct xfrm_state
	fix xfrm_ompat size Reported-by: default avatarkernel test robot <lkp@intel.com>
	accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present

Co-developed-by: default avatarThomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: default avatarThomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 23b6a6df

include/net/xfrm.h

+5 −0
Original line number Diff line number Diff line
@@ -200,6 +200,11 @@ struct xfrm_state { 
	struct xfrm_algo_aead	*aead;

	const char		*geniv;



	/* mapping change rate limiting */

	__be16 new_mapping_sport;

	u32 new_mapping;	/* seconds */

	u32 mapping_maxage;	/* seconds for input SA */



	/* Data for encapsulator */

	struct xfrm_encap_tmpl	*encap;

	struct sock __rcu	*encap_sk;

include/uapi/linux/xfrm.h

+1 −0
Original line number Diff line number Diff line
@@ -313,6 +313,7 @@ enum xfrm_attr_type_t { 
	XFRMA_SET_MARK,		/* __u32 */

	XFRMA_SET_MARK_MASK,	/* __u32 */

	XFRMA_IF_ID,		/* __u32 */

	XFRMA_MTIMER_THRESH,	/* __u32 in seconds for input SA */

	__XFRMA_MAX



#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK	/* Compatibility */

net/xfrm/xfrm_compat.c

+4 −2
Original line number Diff line number Diff line
@@ -127,6 +127,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { 
	[XFRMA_SET_MARK]	= { .type = NLA_U32 },

	[XFRMA_SET_MARK_MASK]	= { .type = NLA_U32 },

	[XFRMA_IF_ID]		= { .type = NLA_U32 },

	[XFRMA_MTIMER_THRESH]	= { .type = NLA_U32 },

};



static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
@@ -274,9 +275,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src) 
	case XFRMA_SET_MARK:

	case XFRMA_SET_MARK_MASK:

	case XFRMA_IF_ID:

	case XFRMA_MTIMER_THRESH:

		return xfrm_nla_cpy(dst, src, nla_len(src));

	default:

		BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);

		BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);

		pr_warn_once("unsupported nla_type %d\n", src->nla_type);

		return -EOPNOTSUPP;

	}
@@ -431,7 +433,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla, 
	int err;



	if (type > XFRMA_MAX) {

		BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);

		BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);

		NL_SET_ERR_MSG(extack, "Bad attribute");

		return -EOPNOTSUPP;

	}

net/xfrm/xfrm_state.c

+22 −1
Original line number Diff line number Diff line
@@ -1593,6 +1593,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, 
	x->km.seq = orig->km.seq;

	x->replay = orig->replay;

	x->preplay = orig->preplay;

	x->mapping_maxage = orig->mapping_maxage;

	x->new_mapping = 0;

	x->new_mapping_sport = 0;



	return x;
@@ -2242,7 +2245,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol) 
}

EXPORT_SYMBOL(km_query);



int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)

static int __km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)

{

	int err = -EINVAL;

	struct xfrm_mgr *km;
@@ -2257,6 +2260,24 @@ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport) 
	rcu_read_unlock();

	return err;

}



int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport)

{

	int ret = 0;



	if (x->mapping_maxage) {

		if ((jiffies / HZ - x->new_mapping) > x->mapping_maxage ||

		    x->new_mapping_sport != sport) {

			x->new_mapping_sport = sport;

			x->new_mapping = jiffies / HZ;

			ret = __km_new_mapping(x, ipaddr, sport);

		}

	} else {

		ret = __km_new_mapping(x, ipaddr, sport);

	}



	return ret;

}

EXPORT_SYMBOL(km_new_mapping);



void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)

net/xfrm/xfrm_user.c

+17 −1
Original line number Diff line number Diff line
@@ -282,6 +282,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, 


	err = 0;



	if (attrs[XFRMA_MTIMER_THRESH])

		if (!attrs[XFRMA_ENCAP])

			err = -EINVAL;



out:

	return err;

}
@@ -521,6 +525,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 
	struct nlattr *lt = attrs[XFRMA_LTIME_VAL];

	struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];

	struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];

	struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];



	if (re) {

		struct xfrm_replay_state_esn *replay_esn;
@@ -552,6 +557,9 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, 


	if (rt)

		x->replay_maxdiff = nla_get_u32(rt);



	if (mt)

		x->mapping_maxage = nla_get_u32(mt);

}



static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
@@ -1024,8 +1032,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x, 
		if (ret)

			goto out;

	}

	if (x->security)

	if (x->security) {

		ret = copy_sec_ctx(x->security, skb);

		if (ret)

			goto out;

	}

	if (x->mapping_maxage)

		ret = nla_put_u32(skb, XFRMA_MTIMER_THRESH, x->mapping_maxage);

out:

	return ret;

}
@@ -3069,6 +3082,9 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) 
	/* Must count x->lastused as it may become non-zero behind our back. */

	l += nla_total_size_64bit(sizeof(u64));



	if (x->mapping_maxage)

		l += nla_total_size(sizeof(x->mapping_maxage));



	return l;

}