2008-11-26 09:14:31 +08:00
|
|
|
#ifndef __NETNS_XFRM_H
|
|
|
|
#define __NETNS_XFRM_H
|
|
|
|
|
2008-11-26 09:16:11 +08:00
|
|
|
#include <linux/list.h>
|
2008-11-26 09:21:01 +08:00
|
|
|
#include <linux/wait.h>
|
2008-11-26 09:19:07 +08:00
|
|
|
#include <linux/workqueue.h>
|
2008-11-26 09:23:26 +08:00
|
|
|
#include <linux/xfrm.h>
|
2010-01-25 14:47:53 +08:00
|
|
|
#include <net/dst_ops.h>
|
2014-01-18 09:55:27 +08:00
|
|
|
#include <net/flowcache.h>
|
2008-11-26 09:16:11 +08:00
|
|
|
|
2008-11-26 10:00:48 +08:00
|
|
|
struct ctl_table_header;
|
|
|
|
|
2008-11-26 09:23:48 +08:00
|
|
|
struct xfrm_policy_hash {
|
|
|
|
struct hlist_head *table;
|
|
|
|
unsigned int hmask;
|
xfrm: hash prefixed policies based on preflen thresholds
The idea is an extension of the current policy hashing.
Today only non-prefixed policies are stored in a hash table. This
patch relaxes the constraints, and hashes policies whose prefix
lengths are greater or equal to a configurable threshold.
Each hash table (one per direction) maintains its own set of IPv4 and
IPv6 thresholds (dbits4, sbits4, dbits6, sbits6), by default (32, 32,
128, 128).
Example, if the output hash table is configured with values (16, 24,
56, 64):
ip xfrm policy add dir out src 10.22.0.0/20 dst 10.24.1.0/24 ... => hashed
ip xfrm policy add dir out src 10.22.0.0/16 dst 10.24.1.1/32 ... => hashed
ip xfrm policy add dir out src 10.22.0.0/16 dst 10.24.0.0/16 ... => unhashed
ip xfrm policy add dir out \
src 3ffe:304:124:2200::/60 dst 3ffe:304:124:2401::/64 ... => hashed
ip xfrm policy add dir out \
src 3ffe:304:124:2200::/56 dst 3ffe:304:124:2401::2/128 ... => hashed
ip xfrm policy add dir out \
src 3ffe:304:124:2200::/56 dst 3ffe:304:124:2400::/56 ... => unhashed
The high order bits of the addresses (up to the threshold) are used to
compute the hash key.
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2014-08-29 22:16:04 +08:00
|
|
|
u8 dbits4;
|
|
|
|
u8 sbits4;
|
|
|
|
u8 dbits6;
|
|
|
|
u8 sbits6;
|
2008-11-26 09:23:48 +08:00
|
|
|
};
|
|
|
|
|
xfrm: configure policy hash table thresholds by netlink
Enable to specify local and remote prefix length thresholds for the
policy hash table via a netlink XFRM_MSG_NEWSPDINFO message.
prefix length thresholds are specified by XFRMA_SPD_IPV4_HTHRESH and
XFRMA_SPD_IPV6_HTHRESH optional attributes (struct xfrmu_spdhthresh).
example:
struct xfrmu_spdhthresh thresh4 = {
.lbits = 0;
.rbits = 24;
};
struct xfrmu_spdhthresh thresh6 = {
.lbits = 0;
.rbits = 56;
};
struct nlmsghdr *hdr;
struct nl_msg *msg;
msg = nlmsg_alloc();
hdr = nlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, XFRMA_SPD_IPV4_HTHRESH, sizeof(__u32), NLM_F_REQUEST);
nla_put(msg, XFRMA_SPD_IPV4_HTHRESH, sizeof(thresh4), &thresh4);
nla_put(msg, XFRMA_SPD_IPV6_HTHRESH, sizeof(thresh6), &thresh6);
nla_send_auto(sk, msg);
The numbers are the policy selector minimum prefix lengths to put a
policy in the hash table.
- lbits is the local threshold (source address for out policies,
destination address for in and fwd policies).
- rbits is the remote threshold (destination address for out
policies, source address for in and fwd policies).
The default values are:
XFRMA_SPD_IPV4_HTHRESH: 32 32
XFRMA_SPD_IPV6_HTHRESH: 128 128
Dynamic re-building of the SPD is performed when the thresholds values
are changed.
The current thresholds can be read via a XFRM_MSG_GETSPDINFO request:
the kernel replies to XFRM_MSG_GETSPDINFO requests by an
XFRM_MSG_NEWSPDINFO message, with both attributes
XFRMA_SPD_IPV4_HTHRESH and XFRMA_SPD_IPV6_HTHRESH.
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2014-08-29 22:16:05 +08:00
|
|
|
struct xfrm_policy_hthresh {
|
|
|
|
struct work_struct work;
|
|
|
|
seqlock_t lock;
|
|
|
|
u8 lbits4;
|
|
|
|
u8 rbits4;
|
|
|
|
u8 lbits6;
|
|
|
|
u8 rbits6;
|
|
|
|
};
|
|
|
|
|
2008-11-26 09:14:31 +08:00
|
|
|
struct netns_xfrm {
|
2008-11-26 09:16:11 +08:00
|
|
|
struct list_head state_all;
|
2008-11-26 09:16:58 +08:00
|
|
|
/*
|
|
|
|
* Hash table to find appropriate SA towards given target (endpoint of
|
|
|
|
* tunnel or destination of transport mode) allowed by selector.
|
|
|
|
*
|
|
|
|
* Main use is finding SA after policy selected tunnel or transport
|
|
|
|
* mode. Also, it can be used by ah/esp icmp error handler to find
|
|
|
|
* offending SA.
|
|
|
|
*/
|
2016-08-09 18:16:09 +08:00
|
|
|
struct hlist_head __rcu *state_bydst;
|
|
|
|
struct hlist_head __rcu *state_bysrc;
|
|
|
|
struct hlist_head __rcu *state_byspi;
|
2008-11-26 09:18:12 +08:00
|
|
|
unsigned int state_hmask;
|
2008-11-26 09:18:39 +08:00
|
|
|
unsigned int state_num;
|
2008-11-26 09:19:07 +08:00
|
|
|
struct work_struct state_hash_work;
|
2008-11-26 09:20:11 +08:00
|
|
|
struct hlist_head state_gc_list;
|
2008-11-26 09:20:36 +08:00
|
|
|
struct work_struct state_gc_work;
|
2008-11-26 09:21:01 +08:00
|
|
|
|
2008-11-26 09:22:11 +08:00
|
|
|
struct list_head policy_all;
|
2008-11-26 09:22:35 +08:00
|
|
|
struct hlist_head *policy_byidx;
|
2008-11-26 09:22:58 +08:00
|
|
|
unsigned int policy_idx_hmask;
|
2014-11-13 17:09:49 +08:00
|
|
|
struct hlist_head policy_inexact[XFRM_POLICY_MAX];
|
|
|
|
struct xfrm_policy_hash policy_bydst[XFRM_POLICY_MAX];
|
2008-11-26 09:24:15 +08:00
|
|
|
unsigned int policy_count[XFRM_POLICY_MAX * 2];
|
2008-11-26 09:28:57 +08:00
|
|
|
struct work_struct policy_hash_work;
|
xfrm: configure policy hash table thresholds by netlink
Enable to specify local and remote prefix length thresholds for the
policy hash table via a netlink XFRM_MSG_NEWSPDINFO message.
prefix length thresholds are specified by XFRMA_SPD_IPV4_HTHRESH and
XFRMA_SPD_IPV6_HTHRESH optional attributes (struct xfrmu_spdhthresh).
example:
struct xfrmu_spdhthresh thresh4 = {
.lbits = 0;
.rbits = 24;
};
struct xfrmu_spdhthresh thresh6 = {
.lbits = 0;
.rbits = 56;
};
struct nlmsghdr *hdr;
struct nl_msg *msg;
msg = nlmsg_alloc();
hdr = nlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, XFRMA_SPD_IPV4_HTHRESH, sizeof(__u32), NLM_F_REQUEST);
nla_put(msg, XFRMA_SPD_IPV4_HTHRESH, sizeof(thresh4), &thresh4);
nla_put(msg, XFRMA_SPD_IPV6_HTHRESH, sizeof(thresh6), &thresh6);
nla_send_auto(sk, msg);
The numbers are the policy selector minimum prefix lengths to put a
policy in the hash table.
- lbits is the local threshold (source address for out policies,
destination address for in and fwd policies).
- rbits is the remote threshold (destination address for out
policies, source address for in and fwd policies).
The default values are:
XFRMA_SPD_IPV4_HTHRESH: 32 32
XFRMA_SPD_IPV6_HTHRESH: 128 128
Dynamic re-building of the SPD is performed when the thresholds values
are changed.
The current thresholds can be read via a XFRM_MSG_GETSPDINFO request:
the kernel replies to XFRM_MSG_GETSPDINFO requests by an
XFRM_MSG_NEWSPDINFO message, with both attributes
XFRMA_SPD_IPV4_HTHRESH and XFRMA_SPD_IPV6_HTHRESH.
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2014-08-29 22:16:05 +08:00
|
|
|
struct xfrm_policy_hthresh policy_hthresh;
|
2008-11-26 09:38:20 +08:00
|
|
|
|
2010-01-25 14:47:53 +08:00
|
|
|
|
2008-11-26 09:38:20 +08:00
|
|
|
struct sock *nlsk;
|
2009-12-03 10:29:05 +08:00
|
|
|
struct sock *nlsk_stash;
|
2008-11-26 10:00:48 +08:00
|
|
|
|
|
|
|
u32 sysctl_aevent_etime;
|
|
|
|
u32 sysctl_aevent_rseqth;
|
|
|
|
int sysctl_larval_drop;
|
|
|
|
u32 sysctl_acq_expires;
|
|
|
|
#ifdef CONFIG_SYSCTL
|
|
|
|
struct ctl_table_header *sysctl_hdr;
|
|
|
|
#endif
|
2010-10-14 13:56:18 +08:00
|
|
|
|
|
|
|
struct dst_ops xfrm4_dst_ops;
|
2011-12-10 17:48:31 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2010-10-14 13:56:18 +08:00
|
|
|
struct dst_ops xfrm6_dst_ops;
|
|
|
|
#endif
|
2013-11-07 17:47:50 +08:00
|
|
|
spinlock_t xfrm_state_lock;
|
|
|
|
rwlock_t xfrm_policy_lock;
|
|
|
|
struct mutex xfrm_cfg_mutex;
|
2014-01-18 09:55:27 +08:00
|
|
|
|
|
|
|
/* flow cache part */
|
|
|
|
struct flow_cache flow_cache_global;
|
|
|
|
atomic_t flow_cache_genid;
|
|
|
|
struct list_head flow_cache_gc_list;
|
2016-02-22 17:40:07 +08:00
|
|
|
atomic_t flow_cache_gc_count;
|
2014-01-18 09:55:27 +08:00
|
|
|
spinlock_t flow_cache_gc_lock;
|
|
|
|
struct work_struct flow_cache_gc_work;
|
|
|
|
struct work_struct flow_cache_flush_work;
|
|
|
|
struct mutex flow_flush_sem;
|
2008-11-26 09:14:31 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
#endif
|