Skip to content
  1. Nov 01, 2021
    • Taehee Yoo's avatar
      amt: add multicast(IGMP) report message handler · bc54e49c
      Taehee Yoo authored
      
      
      amt 'Relay' interface manages multicast groups(igmp/mld) and sources.
      In order to manage, it should have the function to parse igmp/mld
      report messages. So, this adds the logic for parsing igmp report messages
      and saves them on their own data structure.
      
         struct amt_group_node means one group(igmp/mld).
         struct amt_source_node means one source.
      
      The same source can't exist in the same group.
      The same group can exist in the same tunnel because it manages
      the host address too.
      
      The group information is used when forwarding multicast data.
      If there are no groups in the specific tunnel, Relay doesn't forward it.
      
      Although Relay manages sources, it doesn't support the source filtering
      feature. Because the reason to manage sources is just that in order
      to manage group more correctly.
      
      In the next patch, MLD part will be added.
      
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bc54e49c
    • Taehee Yoo's avatar
      amt: add data plane of amt interface · cbc21dc1
      Taehee Yoo authored
      
      
      Before forwarding multicast traffic, the amt interface establishes between
      gateway and relay. In order to establish, amt defined some message type
      and those message flow looks like the below.
      
                            Gateway                  Relay
                            -------                  -----
                               :        Request        :
                           [1] |           N           |
                               |---------------------->|
                               |    Membership Query   | [2]
                               |    N,MAC,gADDR,gPORT  |
                               |<======================|
                           [3] |   Membership Update   |
                               |   ({G:INCLUDE({S})})  |
                               |======================>|
                               |                       |
          ---------------------:-----------------------:---------------------
         |                     |                       |                     |
         |                     |    *Multicast Data    |  *IP Packet(S,G)    |
         |                     |      gADDR,gPORT      |<-----------------() |
         |    *IP Packet(S,G)  |<======================|                     |
         | ()<-----------------|                       |                     |
         |                     |                       |                     |
          ---------------------:-----------------------:---------------------
                               ~                       ~
                               ~        Request        ~
                           [4] |           N'          |
                               |---------------------->|
                               |   Membership Query    | [5]
                               | N',MAC',gADDR',gPORT' |
                               |<======================|
                           [6] |                       |
                               |       Teardown        |
                               |   N,MAC,gADDR,gPORT   |
                               |---------------------->|
                               |                       | [7]
                               |   Membership Update   |
                               |  ({G:INCLUDE({S})})   |
                               |======================>|
                               |                       |
          ---------------------:-----------------------:---------------------
         |                     |                       |                     |
         |                     |    *Multicast Data    |  *IP Packet(S,G)    |
         |                     |     gADDR',gPORT'     |<-----------------() |
         |    *IP Packet (S,G) |<======================|                     |
         | ()<-----------------|                       |                     |
         |                     |                       |                     |
          ---------------------:-----------------------:---------------------
                               |                       |
                               :                       :
      
      1. Discovery
       - Sent by Gateway to Relay
       - To find Relay unique ip address
      2. Advertisement
       - Sent by Relay to Gateway
       - Contains the unique IP address
      3. Request
       - Sent by Gateway to Relay
       - Solicit to receive 'Query' message.
      4. Query
       - Sent by Relay to Gateway
       - Contains General Query message.
      5. Update
       - Sent by  Gateway to Relay
       - Contains report message.
      6. Multicast Data
       - Sent by Relay to Gateway
       - encapsulated multicast traffic.
      7. Teardown
       - Not supported at this time.
      
      Except for the Teardown message, it supports all messages.
      
      In the next patch, IGMP/MLD logic will be added.
      
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cbc21dc1
    • Taehee Yoo's avatar
      amt: add control plane of amt interface · b9022b53
      Taehee Yoo authored
      
      
      It adds definitions and control plane code for AMT.
      this is very similar to udp tunneling interfaces such as gtp, vxlan, etc.
      In the next patch, data plane code will be added.
      
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b9022b53
    • David S. Miller's avatar
      Merge branch 'netdevsim-device-and-bus' · 741948ff
      David S. Miller authored
      
      
      Jakub Kicinski says:
      
      ====================
      netdevsim: improve separation between device and bus
      
      VF config falls strangely in between device and bus
      responsibilities today. Because of this bus.c sticks fingers
      directly into struct nsim_dev and we look at nsim_bus_dev
      in many more places than necessary.
      
      Make bus.c contain pure interface code, and move
      the particulars of the logic (which touch on eswitch,
      devlink reloads etc) to dev.c. Rename the functions
      at the boundary of the interface to make the separation
      clearer.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      741948ff
    • Jakub Kicinski's avatar
      netdevsim: rename 'driver' entry points · a66f64b8
      Jakub Kicinski authored
      
      
      Rename functions serving as driver entry points
      from nsim_dev_... to nsim_drv_... this makes the
      API boundary between bus and dev clearer.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a66f64b8
    • Jakub Kicinski's avatar
      netdevsim: move max vf config to dev · a3353ec3
      Jakub Kicinski authored
      
      
      max_vfs is a strange little beast because the file
      hangs off of nsim's debugfs, but it configures a field
      in the bus device. Move it to dev.c, let's look at it
      as if the device driver was imposing VF limit based
      on FW info (like pci_sriov_set_totalvfs()).
      
      Again, when moving refactor the function not to hold
      the vfs lock pointlessly while parsing the input.
      Wrap the access from the read side in READ_ONCE()
      to appease concurrency checkers. Do not check if
      return value from snprintf() is negative...
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a3353ec3
    • Jakub Kicinski's avatar
      netdevsim: move details of vf config to dev · 1c401078
      Jakub Kicinski authored
      
      
      Since "eswitch" configuration was added bus.c contains
      a lot of device details which really belong to dev.c.
      
      Restructure the code while moving it.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c401078
    • Jakub Kicinski's avatar
      netdevsim: move vfconfig to nsim_dev · 5e388f3d
      Jakub Kicinski authored
      
      
      When netdevsim got split into the faux bus vfconfig ended
      up in the bus device (think pci_dev) which is strange because
      it contains very networky not to say netdevy information.
      Move it to nsim_dev, which is the driver "priv" structure
      for the device.
      
      To make sure we don't race with probe/remove take
      the device lock (much like PCI).
      
      While at it remove the NULL-checking of vfconfigs.
      It appears to be pointless.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5e388f3d
    • Jakub Kicinski's avatar
      netdevsim: take rtnl_lock when assigning num_vfs · 26c37d89
      Jakub Kicinski authored
      
      
      Legacy VF NDOs look at num_vfs and then based on that
      index into vfconfig. If we don't rtnl_lock() num_vfs
      may get set to 0 and vfconfig freed/replaced while
      the NDO is running.
      
      We don't need to protect replacing vfconfig since it's
      only done when num_vfs is 0.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26c37d89
    • David S. Miller's avatar
      Merge branch 'devlink-locking' · 1adc58ea
      David S. Miller authored
      Jakub Kicinski says:
      
      ====================
      improve ethtool/rtnl vs devlink locking
      
      During ethtool netlink development we decided to move some of
      the commmands to devlink. Since we don't want drivers to implement
      both devlink and ethtool version of the commands ethtool ioctl
      falls back to calling devlink. Unfortunately devlink locks must
      be taken before rtnl_lock. This results in a questionable
      dev_hold() / rtnl_unlock() / devlink / rtnl_lock() / dev_put()
      pattern.
      
      This method "works" but it working depends on drivers in question
      not doing much in ethtool_ops->begin / complete, and on the netdev
      not having needs_free_netdev set.
      
      Since commit 437ebfd9
      
       ("devlink: Count struct devlink consumers")
      we can hold a reference on a devlink instance and prevent it from
      going away (sort of like netdev with dev_hold()). We can use this
      to create a more natural reference nesting where we get a ref on
      the devlink instance and make the devlink call entirely outside
      of the rtnl_lock section.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1adc58ea
    • Jakub Kicinski's avatar
      ethtool: don't drop the rtnl_lock half way thru the ioctl · 1af0a094
      Jakub Kicinski authored
      
      
      devlink compat code needs to drop rtnl_lock to take
      devlink->lock to ensure correct lock ordering.
      
      This is problematic because we're not strictly guaranteed
      that the netdev will not disappear after we re-lock.
      It may open a possibility of nested ->begin / ->complete
      calls.
      
      Instead of calling into devlink under rtnl_lock take
      a ref on the devlink instance and make the call after
      we've dropped rtnl_lock.
      
      We (continue to) assume that netdevs have an implicit
      reference on the devlink returned from ndo_get_devlink_port
      
      Note that ndo_get_devlink_port will now get called
      under rtnl_lock. That should be fine since none of
      the drivers seem to be taking serious locks inside
      ndo_get_devlink_port.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1af0a094
    • Jakub Kicinski's avatar
      devlink: expose get/put functions · 46db1b77
      Jakub Kicinski authored
      
      
      Allow those who hold implicit reference on a devlink instance
      to try to take a full ref on it. This will be used from netdev
      code which has an implicit ref because of driver call ordering.
      
      Note that after recent changes devlink_unregister() may happen
      before netdev unregister, but devlink_free() should still happen
      after, so we are safe to try, but we can't just refcount_inc()
      and assume it's not zero.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      46db1b77
    • Jakub Kicinski's avatar
      ethtool: handle info/flash data copying outside rtnl_lock · 095cfcfe
      Jakub Kicinski authored
      
      
      We need to increase the lifetime of the data for .get_info
      and .flash_update beyond their handlers inside rtnl_lock.
      
      Allocate a union on the heap and use it instead.
      
      Note that we now copy the ethcmd before we lookup dev,
      hopefully there is no crazy user space depending on error
      codes.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      095cfcfe
    • Jakub Kicinski's avatar
      ethtool: push the rtnl_lock into dev_ethtool() · f49deaa6
      Jakub Kicinski authored
      
      
      Don't take the lock in net/core/dev_ioctl.c,
      we'll have things to do outside rtnl_lock soon.
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f49deaa6
    • David S. Miller's avatar
      Merge branch 'mana-misc' · c6e03dbe
      David S. Miller authored
      
      
      Dexuan Cui says:
      
      ====================
      net: mana: some misc patches
      
      Patch 1 is a small fix.
      
      Patch 2 reports OS info to the PF driver.
      Before the patch, the req fields were all zeros.
      
      Patch 3 fixes and cleans up the error handling of HWC creation failure.
      
      Patch 4 adds the callbacks for hibernation/kexec. It's based on patch 3.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6e03dbe
    • Dexuan Cui's avatar
      net: mana: Support hibernation and kexec · 635096a8
      Dexuan Cui authored
      
      
      Implement the suspend/resume/shutdown callbacks for hibernation/kexec.
      
      Add mana_gd_setup() and mana_gd_cleanup() for some common code, and
      use them in the mand_gd_* callbacks.
      
      Reuse mana_probe/remove() for the hibernation path.
      
      Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      635096a8
    • Dexuan Cui's avatar
      net: mana: Improve the HWC error handling · 62ea8b77
      Dexuan Cui authored
      
      
      Currently when the HWC creation fails, the error handling is flawed,
      e.g. if mana_hwc_create_channel() -> mana_hwc_establish_channel() fails,
      the resources acquired in mana_hwc_init_queues() is not released.
      
      Enhance mana_hwc_destroy_channel() to do the proper cleanup work and
      call it accordingly.
      
      Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      62ea8b77
    • Dexuan Cui's avatar
      net: mana: Report OS info to the PF driver · 3c37f357
      Dexuan Cui authored
      
      
      The PF driver might use the OS info for statistical purposes.
      
      Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3c37f357
    • Dexuan Cui's avatar
      net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() · 6c7ea696
      Dexuan Cui authored
      
      
      Use the correct port index rather than 0.
      
      Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
      Reviewed-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c7ea696
    • David S. Miller's avatar
      Merge branch 'mptcp-selftests' · 986d2e3d
      David S. Miller authored
      
      
      Mat Martineau says:
      
      ====================
      mptcp: Some selftest improvements
      
      Here are a couple of selftest changes for MPTCP.
      
      Patch 1 fixes a mistake where the wrong protocol (TCP vs MPTCP) could be
      requested on the listening socket in some link failure tests.
      
      Patch 2 refactors the simulataneous flow tests to improve timing
      accuracy and give more consistent results.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      986d2e3d
    • Paolo Abeni's avatar
      selftests: mptcp: more stable simult_flows tests · b6ab64b0
      Paolo Abeni authored
      
      
      Currently the simult_flows.sh self-tests are not very stable,
      especially when running on slow VMs.
      
      The tests measure runtime for transfers on multiple subflows
      and check that the time is near the theoretical maximum.
      
      The current test infra introduces a bit of jitter in test
      runtime, due to multiple explicit delays. Additionally the
      runtime is measured by the shell script wrapper. On a slow
      VM, the script overhead is measurable and subject to relevant
      jitter.
      
      One solution to make the test more stable would be adding more
      slack to the expected time; that could possibly hide real
      regressions. Instead move the measurement inside the command
      doing the transfer, and drop most unneeded sleeps.
      
      Reviewed-by: default avatarMatthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b6ab64b0
    • Geliang Tang's avatar
      selftests: mptcp: fix proto type in link_failure tests · 7c909a98
      Geliang Tang authored
      In listener_ns, we should pass srv_proto argument to mptcp_connect command,
      not cl_proto.
      
      Fixes: 7d1e6f16
      
       ("selftests: mptcp: add testcase for active-back")
      Signed-off-by: default avatarGeliang Tang <geliang.tang@suse.com>
      Signed-off-by: default avatarMatthieu Baerts <matthieu.baerts@tessares.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c909a98
    • Yu Xiao's avatar
      nfp: flower: Allow ipv6gretap interface for offloading · f7536ffb
      Yu Xiao authored
      
      
      The tunnel_type check only allows for "netif_is_gretap", but for
      OVS the port is actually "netif_is_ip6gretap" when setting up GRE
      for ipv6, which means offloading request was rejected before.
      
      Therefore, adding "netif_is_ip6gretap" allow ipv6gretap interface
      for offloading.
      
      Signed-off-by: default avatarYu Xiao <yu.xiao@corigine.com>
      Signed-off-by: default avatarLouis Peens <louis.peens@corigine.com>
      Signed-off-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f7536ffb
    • Marek Behún's avatar
      net: dsa: populate supported_interfaces member · c07c6e8e
      Marek Behún authored
      
      
      Add a new DSA switch operation, phylink_get_interfaces, which should
      fill in which PHY_INTERFACE_MODE_* are supported by given port.
      
      Use this before phylink_create() to fill phylinks supported_interfaces
      member, allowing phylink to determine which PHY_INTERFACE_MODEs are
      supported.
      
      Signed-off-by: default avatarMarek Behún <kabel@kernel.org>
      [tweaked patch and description to add more complete support -- rmk]
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c07c6e8e
    • David S. Miller's avatar
      Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue · ebed1cf5
      David S. Miller authored
      
      
      Tony Nguyen says:
      
      ====================
      100GbE Intel Wired LAN Driver Updates 2021-10-29
      
      This series contains updates to ice and iavf drivers and virtchnl header
      file.
      
      Brett removes vlan_promisc argument from a function call for ice driver.
      In the virtchnl header file he removes an unused, reserved define and
      converts raw value defines to instead use the BIT macro.
      
      Marcin adds syncing of MAC addresses when creating switchdev VFs to
      remove error messages on link up and stops showing buffer information
      for port representors to remove duplicated entries being displayed for
      ice driver.
      
      Karen introduces a helper to go from pci_dev to iavf_adapter in the
      iavf driver.
      
      Przemyslaw fixes an issue where iavf was attempting to free IRQs before
      calling disable.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ebed1cf5
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next · 06f1ecd4
      David S. Miller authored
      
      
      Steffen Klassert says:
      
      ====================
      pull request (net-next): ipsec-next 2021-10-30
      
      Just two minor changes this time:
      
      1) Remove some superfluous header files from xfrm4_tunnel.c
         From Mianhan Liu.
      
      2) Simplify some error checks in xfrm_input().
         From luo penghao.
      
      Please pull or let me know if there are problems.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      06f1ecd4
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · 894d0844
      David S. Miller authored
      
      
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter updates for net-next
      
      The following patchset contains Netfilter updates for net-next:
      
      1) Use array_size() in ebtables, from Gustavo A. R. Silva.
      
      2) Attach IPS_ASSURED to internal UDP stream state, reported by
         Maciej Zenczykowski.
      
      3) Add NFT_META_IFTYPE to match on the interface type either
         from ingress or egress.
      
      4) Generalize pktinfo->tprot_set to flags field.
      
      5) Allow to match on inner headers / payload data.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      894d0844
    • David S. Miller's avatar
      Merge tag 'mlx5-updates-2021-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · 2aec919f
      David S. Miller authored
      
      
      Saeed Mahameed says:
      
      ====================
      mlx5-updates-2021-10-29
      
      1) Minor trivial refactoring and improvements
      2) Check for unsupported parameters fields in SW steering
      3) Support TC offload for OVS internal port, from Ariel, see below.
      
      Ariel Levkovich says:
      
      =====================
      
      Support HW offload of TC rules involving OVS internal port
      device type as the filter device or the destination
      device.
      
      The support is for flows which explicitly use the internal
      port as source or destination device as well as indirect offload
      for flows performing tunnel set or unset via a tunnel device
      and the internal port is the tunnel overlay device.
      
      Since flows with internal port as source port are added
      as egress rules while redirecting to internal port is done
      as an ingress redirect, the series introduces the necessary
      changes in mlx5_core driver to support the new types of flows
      and actions.
      
      =====================
      
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2aec919f
    • Pablo Neira Ayuso's avatar
      netfilter: nft_payload: support for inner header matching / mangling · c46b38dc
      Pablo Neira Ayuso authored
      
      
      Allow to match and mangle on inner headers / payload data after the
      transport header. There is a new field in the pktinfo structure that
      stores the inner header offset which is calculated only when requested.
      Only TCP and UDP supported at this stage.
      
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c46b38dc
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: convert pktinfo->tprot_set to flags field · b5bdc6f9
      Pablo Neira Ayuso authored
      
      
      Generalize boolean field to store more flags on the pktinfo structure.
      
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b5bdc6f9
    • Pablo Neira Ayuso's avatar
      netfilter: nft_meta: add NFT_META_IFTYPE · 56fa9501
      Pablo Neira Ayuso authored
      
      
      Generalize NFT_META_IIFTYPE to NFT_META_IFTYPE which allows you to match
      on the interface type of the skb->dev field. This field is used by the
      netdev family to add an implicit dependency to skip non-ethernet packets
      when matching on layer 3 and 4 TCP/IP header fields.
      
      For backward compatibility, add the NFT_META_IIFTYPE alias to
      NFT_META_IFTYPE.
      
      Add __NFT_META_IIFTYPE, to be used by userspace in the future to match
      specifically on the iiftype.
      
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      56fa9501
    • Pablo Neira Ayuso's avatar
      netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state · b7b1d02f
      Pablo Neira Ayuso authored
      
      
      The internal stream state sets the timeout to 120 seconds 2 seconds
      after the creation of the flow, attach this internal stream state to the
      IPS_ASSURED flag for consistent event reporting.
      
      Before this patch:
      
            [NEW] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 [UNREPLIED] src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
         [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
         [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
        [DESTROY] udp      17 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
      
      Note IPS_ASSURED for the flow not yet in the internal stream state.
      
      after this update:
      
            [NEW] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 [UNREPLIED] src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
         [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
         [UPDATE] udp      17 120 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
        [DESTROY] udp      17 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
      
      Before this patch, short-lived UDP flows never entered IPS_ASSURED, so
      they were already candidate flow to be deleted by early_drop under
      stress.
      
      Before this patch, IPS_ASSURED is set on regardless the internal stream
      state, attach this internal stream state to IPS_ASSURED.
      
      packet #1 (original direction) enters NEW state
      packet #2 (reply direction) enters ESTABLISHED state, sets on IPS_SEEN_REPLY
      paclet #3 (any direction) sets on IPS_ASSURED (if 2 seconds since the
                creation has passed by).
      
      Reported-by: default avatarMaciej Żenczykowski <zenczykowski@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b7b1d02f
  2. Oct 30, 2021