From: Christian Hopps <chopps@chopps•org>
To: devel@linux-ipsec•org
Cc: Steffen Klassert <steffen.klassert@secunet•com>,
netdev@vger•kernel.org, Christian Hopps <chopps@chopps•org>,
Christian Hopps <chopps@labn•net>
Subject: [PATCH ipsec-next v1 4/8] iptfs: sysctl: allow configuration of global default values
Date: Mon, 19 Feb 2024 03:57:31 -0500 [thread overview]
Message-ID: <20240219085735.1220113-5-chopps@chopps.org> (raw)
In-Reply-To: <20240219085735.1220113-1-chopps@chopps.org>
From: Christian Hopps <chopps@labn•net>
Add sysctls for the changing the IPTFS default SA values.
Signed-off-by: Christian Hopps <chopps@labn•net>
---
Documentation/networking/xfrm_sysctl.rst | 30 +++++++++++++++++++
include/net/netns/xfrm.h | 6 ++++
net/xfrm/xfrm_sysctl.c | 38 ++++++++++++++++++++++++
3 files changed, 74 insertions(+)
diff --git a/Documentation/networking/xfrm_sysctl.rst b/Documentation/networking/xfrm_sysctl.rst
index 47b9bbdd0179..4d900c74b405 100644
--- a/Documentation/networking/xfrm_sysctl.rst
+++ b/Documentation/networking/xfrm_sysctl.rst
@@ -9,3 +9,33 @@ XFRM Syscall
xfrm_acq_expires - INTEGER
default 30 - hard timeout in seconds for acquire requests
+
+xfrm_iptfs_max_qsize - UNSIGNED INTEGER
+ The default IPTFS max output queue size in octets. The output queue is
+ where received packets destined for output over an IPTFS tunnel are
+ stored prior to being output in aggregated/fragmented form over the
+ IPTFS tunnel.
+
+ Default 1M.
+
+xfrm_iptfs_drop_time - UNSIGNED INTEGER
+ The default IPTFS drop time in microseconds. The drop time is the amount
+ of time before a missing out-of-order IPTFS tunnel packet is considered
+ lost. See also the reorder window.
+
+ Default 1s (1000000).
+
+xfrm_iptfs_init_delay - UNSIGNED INTEGER
+ The default IPTFS initial output delay in microseconds. The initial
+ output delay is the amount of time prior to servicing the output queue
+ after queueing the first packet on said queue. This applies anytime
+ the output queue was previously empty.
+
+ Default 0.
+
+xfrm_iptfs_reorder_window - UNSIGNED INTEGER
+ The default IPTFS reorder window size. The reorder window size dictates
+ the maximum number of IPTFS tunnel packets in a sequence that may arrive
+ out of order.
+
+ Default 3.
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 423b52eca908..e11e71c8ceef 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -66,6 +66,12 @@ struct netns_xfrm {
u32 sysctl_aevent_rseqth;
int sysctl_larval_drop;
u32 sysctl_acq_expires;
+#if IS_ENABLED(CONFIG_XFRM_IPTFS)
+ u32 sysctl_iptfs_drop_time;
+ u32 sysctl_iptfs_init_delay;
+ u32 sysctl_iptfs_max_qsize;
+ u32 sysctl_iptfs_reorder_window;
+#endif
u8 policy_default[XFRM_POLICY_MAX];
diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
index 7fdeafc838a7..dddb1025b7de 100644
--- a/net/xfrm/xfrm_sysctl.c
+++ b/net/xfrm/xfrm_sysctl.c
@@ -10,6 +10,12 @@ static void __net_init __xfrm_sysctl_init(struct net *net)
net->xfrm.sysctl_aevent_rseqth = XFRM_AE_SEQT_SIZE;
net->xfrm.sysctl_larval_drop = 1;
net->xfrm.sysctl_acq_expires = 30;
+#if IS_ENABLED(CONFIG_XFRM_IPTFS)
+ net->xfrm.sysctl_iptfs_max_qsize = 1024 * 1024; /* 1M */
+ net->xfrm.sysctl_iptfs_drop_time = 1000000; /* 1s */
+ net->xfrm.sysctl_iptfs_init_delay = 0; /* no initial delay */
+ net->xfrm.sysctl_iptfs_reorder_window = 3; /* tcp folks suggested */
+#endif
}
#ifdef CONFIG_SYSCTL
@@ -38,6 +44,32 @@ static struct ctl_table xfrm_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+#if IS_ENABLED(CONFIG_XFRM_IPTFS)
+ {
+ .procname = "xfrm_iptfs_drop_time",
+ .maxlen = sizeof(uint),
+ .mode = 0644,
+ .proc_handler = proc_douintvec
+ },
+ {
+ .procname = "xfrm_iptfs_init_delay",
+ .maxlen = sizeof(uint),
+ .mode = 0644,
+ .proc_handler = proc_douintvec
+ },
+ {
+ .procname = "xfrm_iptfs_max_qsize",
+ .maxlen = sizeof(uint),
+ .mode = 0644,
+ .proc_handler = proc_douintvec
+ },
+ {
+ .procname = "xfrm_iptfs_reorder_window",
+ .maxlen = sizeof(uint),
+ .mode = 0644,
+ .proc_handler = proc_douintvec
+ },
+#endif
{}
};
@@ -55,6 +87,12 @@ int __net_init xfrm_sysctl_init(struct net *net)
table[1].data = &net->xfrm.sysctl_aevent_rseqth;
table[2].data = &net->xfrm.sysctl_larval_drop;
table[3].data = &net->xfrm.sysctl_acq_expires;
+#if IS_ENABLED(CONFIG_XFRM_IPTFS)
+ table[4].data = &net->xfrm.sysctl_iptfs_drop_time;
+ table[5].data = &net->xfrm.sysctl_iptfs_init_delay;
+ table[6].data = &net->xfrm.sysctl_iptfs_max_qsize;
+ table[7].data = &net->xfrm.sysctl_iptfs_reorder_window;
+#endif
/* Don't export sysctls to unprivileged users */
if (net->user_ns != &init_user_ns) {
--
2.43.0
next prev parent reply other threads:[~2024-02-19 8:59 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-19 8:57 [PATCH ipsec-next v1 0/8] Add IP-TFS mode to xfrm Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 1/8] iptfs: config: add CONFIG_XFRM_IPTFS Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 2/8] iptfs: uapi: ip: add ip_tfs_*_hdr packet formats Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 3/8] iptfs: uapi: IPPROTO_AGGFRAG AGGFRAG in ESP Christian Hopps
2024-02-19 8:57 ` Christian Hopps [this message]
2024-02-19 8:57 ` [PATCH ipsec-next v1 5/8] iptfs: netlink: add config (netlink) options Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 6/8] iptfs: xfrm: Add mode_cbs module functionality Christian Hopps
2024-02-25 12:17 ` [devel-ipsec] " Antony Antony
2024-03-08 22:21 ` Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 7/8] iptfs: xfrm: add generic iptfs defines and functionality Christian Hopps
2024-02-19 8:57 ` [PATCH ipsec-next v1 8/8] iptfs: impl: add new iptfs xfrm mode impl Christian Hopps
2024-02-19 20:13 ` Simon Horman
2024-02-22 20:23 ` Christian Hopps
2024-02-26 20:57 ` Simon Horman
2024-02-29 9:12 ` Christian Hopps
2024-02-20 23:16 ` kernel test robot
2024-02-25 12:16 ` [devel-ipsec] " Antony Antony
2024-03-06 13:57 ` Sabrina Dubroca
2024-03-06 15:30 ` Christian Hopps
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240219085735.1220113-5-chopps@chopps.org \
--to=chopps@chopps$(echo .)org \
--cc=chopps@labn$(echo .)net \
--cc=devel@linux-ipsec$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=steffen.klassert@secunet$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox