From: Nicolas Dichtel <nicolas.dichtel@6wind•com>
To: Steffen Klassert <steffen.klassert@secunet•com>, netdev@vger•kernel.org
Cc: Christophe Gouault <christophe.gouault@6wind•com>,
Saurabh Mohan <saurabh.mohan@vyatta•com>
Subject: Re: [PATCH RFC 8/9] vti: Update the ipv4 side to use it's own receive hook.
Date: Thu, 12 Dec 2013 17:26:55 +0100 [thread overview]
Message-ID: <52A9E3CF.7040204@6wind.com> (raw)
In-Reply-To: <20131205120504.GE31491@secunet.com>
Le 05/12/2013 13:05, Steffen Klassert a écrit :
> With this patch, vti uses the IPsec protocol multiplexer to
> register it's own receive side hooks for ESP and AH.
>
> Vti now does the following on receive side:
>
> 1. Do an input policy check for the IPsec packet we received.
> This is required because this packet could be already
> prosecces by IPsec, so an inbuond policy check is needed.
>
> 2. Clean the skb to not leak informations on namespace
> transitions.
>
> 3. Mark the packet with the i_key. The policy and the state
> must match this key now. Policy and state belong to the vti
> namespace and policy enforcement is done at the further layers.
>
> 4. Call the generic xfrm layer to do decryption and decapsulation.
>
> 5. Wait for a callback from the xfrm layer to properly update
> the device statistics.
>
> On transmit side:
>
> 1. Mark the packet with the o_key. The policy and the state
> must match this key now.
>
> 2. Do a xfrm_lookup on the original packet with the mark applied.
>
> 3. Check if we got an IPsec route.
>
> 4. Clean the skb to not leak informations on namespace
> transitions.
>
> 5. Attach the dst_enty we got from the xfrm_lookup to the skb.
>
> 6. Call dst_output to do the IPsec processing.
>
> 7. Do the device statistics.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet•com>
> ---
> net/ipv4/ip_vti.c | 124 +++++++++++++++++++++++++++++++++++++----------------
> 1 file changed, 88 insertions(+), 36 deletions(-)
>
> diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
> index 52b802a..fe3d3ab 100644
> --- a/net/ipv4/ip_vti.c
> +++ b/net/ipv4/ip_vti.c
> @@ -41,6 +41,8 @@
> #include <net/ip_tunnels.h>
> #include <net/inet_ecn.h>
> #include <net/xfrm.h>
> +#include <net/esp.h>
> +#include <net/ah.h>
> #include <net/net_namespace.h>
> #include <net/netns/generic.h>
>
> @@ -49,7 +51,6 @@ static struct rtnl_link_ops vti_link_ops __read_mostly;
> static int vti_net_id __read_mostly;
> static int vti_tunnel_init(struct net_device *dev);
>
> -/* We dont digest the packet therefore let the packet pass */
> static int vti_rcv(struct sk_buff *skb)
> {
> struct ip_tunnel *tunnel;
> @@ -60,48 +61,72 @@ static int vti_rcv(struct sk_buff *skb)
> tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
> iph->saddr, iph->daddr, 0);
> if (tunnel != NULL) {
> - struct pcpu_tstats *tstats;
> - u32 oldmark = skb->mark;
> - int ret;
> + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
> + goto drop;
> +
> + XFRM_TUNNEL_SKB_CB(skb)->tunnel = tunnel;
> +
> + /* Partially clear the buffer, the rest is done by xfrm_input. */
> + if (!net_eq(tunnel->net, dev_net(tunnel->dev)))
> + skb_orphan(skb);
> + skb->tstamp.tv64 = 0;
> + skb->pkt_type = PACKET_HOST;
> + skb->skb_iif = 0;
> + nf_reset_trace(skb);
> + secpath_reset(skb);
Is it not better to call skb_scrub_packet() (if necessary adding a new
argument to skip some operations)?
skb_scrub_packet() ensures to perform all needed operations when crossing
netns/tunnel.
It also eases the maintenance and make the code more consistent: when a bug is
fixed in skb_scrub_packet() all users benefit from it (eg 239c78db9c41 net:
clear local_df when passing skb between namespaces), otherwise we will always
forget some users.
Nicolas
next prev parent reply other threads:[~2013-12-12 16:26 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-05 12:00 [PATCH RFC 0/9] vti4: prepare namespace and interfamily support Steffen Klassert
2013-12-05 12:01 ` [PATCH RFC 1/9] xfrm4: Add IPsec protocol multiplexer Steffen Klassert
2013-12-05 12:01 ` [PATCH RFC 2/9] esp4: Use the IPsec protocol multiplexer API Steffen Klassert
2013-12-05 12:02 ` [PATCH RFC 3/9] esp4: Export esp4_err Steffen Klassert
2013-12-05 12:02 ` [PATCH RFC 4/9] ah4: Use the IPsec protocol multiplexer API Steffen Klassert
2013-12-05 12:03 ` [PATCH RFC 5/9] ah4: Export ah4_err Steffen Klassert
2013-12-05 12:03 ` [PATCH RFC 6/9] xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer Steffen Klassert
2013-12-05 12:04 ` [PATCH RFC 7/9] ip_tunnel: Make vti work with i_key set Steffen Klassert
2013-12-05 12:05 ` [PATCH RFC 8/9] vti: Update the ipv4 side to use it's own receive hook Steffen Klassert
2013-12-12 16:26 ` Nicolas Dichtel [this message]
2013-12-13 9:56 ` Steffen Klassert
2013-12-05 12:05 ` [PATCH RFC 9/9] xfrm4: Remove xfrm_tunnel_notifier Steffen Klassert
2013-12-05 17:27 ` [PATCH RFC 0/9] vti4: prepare namespace and interfamily support Stephen Hemminger
2013-12-06 20:20 ` David Miller
2013-12-09 9:17 ` Christophe Gouault
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52A9E3CF.7040204@6wind.com \
--to=nicolas.dichtel@6wind$(echo .)com \
--cc=christophe.gouault@6wind$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=saurabh.mohan@vyatta$(echo .)com \
--cc=steffen.klassert@secunet$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox