From: Robert Shearman <rshearma@brocade•com>
To: "Eric W. Biederman" <ebiederm@xmission•com>
Cc: "davem@davemloft•net" <davem@davemloft•net>,
"netdev@vger•kernel.org" <netdev@vger•kernel.org>
Subject: Re: [PATCH net-next v2 4/5] mpls: Per-device enabling of packet forwarding
Date: Mon, 23 Mar 2015 13:10:46 +0000 [thread overview]
Message-ID: <551010D6.9050305@brocade.com> (raw)
In-Reply-To: <87iods7qbz.fsf@x220.int.ebiederm.org>
On 22/03/15 20:02, Eric W. Biederman wrote:
> Robert Shearman <rshearma@brocade•com> writes:
>
>> An MPLS network is a single trust domain where the edges must be in
>> control of what labels make their way into the core. The simplest way
>> of ensuring for the edge device to always impose the labels, and not
>> allow forward labeled traffic from untrusted neighbours. This is
>> achieved by allowing a per-device configuration of whether MPLS
>> traffic received over that interface should be forwarded or not.
>>
>> To be secure by default, MPLS is now intially disabled on all
>> interfaces (except the loopback) until explicitly enabled and no
>> global option is provided to change the default. Whilst this differs
>> from other protocols (e.g. IPv6), network operators are used to
>> explicitly enabling MPLS forwarding on interfaces, and with the number
>> of links to the MPLS core typically fairly low this doesn't present
>> too much of a burden on operators.
>
> Overall this patch looks like the correct direction to go.
>
> And a default disable is the right way to go for new features, that way
> even if the code is compiled in people don't get surprised by new
> behavior when they upgrade kernels.
>
> It would be very nice if the check for ARPHRD types was moved from
> mpls_route_add to mpls_add_dev. Which would save memory and complexity
> when mpls is not supported on a network device type.
That check is for output, rather than input which is what this patch
affects. If this affected both, or there was a separate knob for the
output side then I'd agree with you.
Thanks,
Rob
>
> Eric
>
>> Cc: "Eric W. Biederman" <ebiederm@xmission•com>
>> Signed-off-by: Robert Shearman <rshearma@brocade•com>
>> ---
>> Documentation/networking/mpls-sysctl.txt | 9 +++
>> include/linux/netdevice.h | 4 ++
>> net/mpls/af_mpls.c | 115 ++++++++++++++++++++++++++++++-
>> net/mpls/internal.h | 6 ++
>> 4 files changed, 133 insertions(+), 1 deletion(-)
>>
>> diff --git a/Documentation/networking/mpls-sysctl.txt b/Documentation/networking/mpls-sysctl.txt
>> index 639ddf0..f48772c 100644
>> --- a/Documentation/networking/mpls-sysctl.txt
>> +++ b/Documentation/networking/mpls-sysctl.txt
>> @@ -18,3 +18,12 @@ platform_labels - INTEGER
>>
>> Possible values: 0 - 1048575
>> Default: 0
>> +
>> +conf/<interface>/forwarding - BOOL
>> + Forward packets received on this interface.
>> +
>> + If disabled, packets will be discarded without further
>> + processing.
>> +
>> + 0 - disabled (default)
>> + not 0 - enabled
>> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
>> index 76951c5..ee4ca06 100644
>> --- a/include/linux/netdevice.h
>> +++ b/include/linux/netdevice.h
>> @@ -60,6 +60,7 @@ struct phy_device;
>> struct wireless_dev;
>> /* 802.15.4 specific */
>> struct wpan_dev;
>> +struct mpls_dev;
>>
>> void netdev_set_default_ethtool_ops(struct net_device *dev,
>> const struct ethtool_ops *ops);
>> @@ -1615,6 +1616,9 @@ struct net_device {
>> void *ax25_ptr;
>> struct wireless_dev *ieee80211_ptr;
>> struct wpan_dev *ieee802154_ptr;
>> +#if IS_ENABLED(CONFIG_MPLS_ROUTING)
>> + struct mpls_dev __rcu *mpls_ptr;
>> +#endif
>>
>> /*
>> * Cache lines mostly used on receive path (including eth_type_trans())
>> diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
>> index e3586a7..14c7e76 100644
>> --- a/net/mpls/af_mpls.c
>> +++ b/net/mpls/af_mpls.c
>> @@ -54,6 +54,11 @@ static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index)
>> return rt;
>> }
>>
>> +static inline struct mpls_dev *mpls_dev_get(const struct net_device *dev)
>> +{
>> + return rcu_dereference_rtnl(dev->mpls_ptr);
>> +}
>> +
>> static bool mpls_output_possible(const struct net_device *dev)
>> {
>> return dev && (dev->flags & IFF_UP) && netif_carrier_ok(dev);
>> @@ -137,6 +142,7 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
>> struct mpls_route *rt;
>> struct mpls_entry_decoded dec;
>> struct net_device *out_dev;
>> + struct mpls_dev *mdev;
>> unsigned int hh_len;
>> unsigned int new_header_size;
>> unsigned int mtu;
>> @@ -144,6 +150,10 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
>>
>> /* Careful this entire function runs inside of an rcu critical section */
>>
>> + mdev = mpls_dev_get(dev);
>> + if (!mdev || !mdev->fwd_enabled)
>> + goto drop;
>> +
>> if (skb->pkt_type != PACKET_HOST)
>> goto drop;
>>
>> @@ -440,10 +450,96 @@ errout:
>> return err;
>> }
>>
>> +#define MPLS_PERDEV_SYSCTL_OFFSET(field) \
>> + (&((struct mpls_dev *)0)->field)
>> +
>> +static const struct ctl_table mpls_dev_table[] = {
>> + {
>> + .procname = "forwarding",
>> + .maxlen = sizeof(int),
>> + .mode = 0644,
>> + .proc_handler = proc_dointvec,
>> + .data = MPLS_PERDEV_SYSCTL_OFFSET(fwd_enabled),
>> + },
>> + { }
>> +};
>> +
>> +static int mpls_dev_sysctl_register(struct net_device *dev,
>> + struct mpls_dev *mdev)
>> +{
>> + char path[sizeof("net/mpls/conf/") + IFNAMSIZ];
>> + struct ctl_table *table;
>> + int i;
>> +
>> + table = kmemdup(&mpls_dev_table, sizeof(mpls_dev_table), GFP_KERNEL);
>> + if (!table)
>> + goto out;
>> +
>> + /* Table data contains only offsets relative to the base of
>> + * the mdev at this point, so make them absolute.
>> + */
>> + for (i = 0; i < ARRAY_SIZE(mpls_dev_table); i++)
>> + table[i].data = (char *)mdev + (uintptr_t)table[i].data;
>> +
>> + snprintf(path, sizeof(path), "net/mpls/conf/%s", dev->name);
>> +
>> + mdev->sysctl = register_net_sysctl(dev_net(dev), path, table);
>> + if (!mdev->sysctl)
>> + goto free;
>> +
>> + return 0;
>> +
>> +free:
>> + kfree(table);
>> +out:
>> + return -ENOBUFS;
>> +}
>> +
>> +static void mpls_dev_sysctl_unregister(struct mpls_dev *mdev)
>> +{
>> + struct ctl_table *table;
>> +
>> + table = mdev->sysctl->ctl_table_arg;
>> + unregister_net_sysctl_table(mdev->sysctl);
>> + kfree(table);
>> +}
>> +
>> +static struct mpls_dev *mpls_add_dev(struct net_device *dev)
>> +{
>> + struct mpls_dev *mdev;
>> + int err = -ENOMEM;
>> +
>> + ASSERT_RTNL();
>> +
>> + mdev = kzalloc(sizeof(*mdev), GFP_KERNEL);
>> + if (!mdev)
>> + return ERR_PTR(err);
>> +
>> + /* Enable MPLS by default on loopback devices, since this
>> + * doesn't represent a security boundary and is required for the
>> + * lookup of inner labels for LSPs terminating on this router.
>> + */
>> + if (dev->flags & IFF_LOOPBACK)
>> + mdev->fwd_enabled = 1;
>> +
>> + err = mpls_dev_sysctl_register(dev, mdev);
>> + if (err)
>> + goto free;
>> +
>> + rcu_assign_pointer(dev->mpls_ptr, mdev);
>> +
>> + return mdev;
>> +
>> +free:
>> + kfree(mdev);
>> + return ERR_PTR(err);
>> +}
>> +
>> static void mpls_ifdown(struct net_device *dev)
>> {
>> struct mpls_route __rcu **platform_label;
>> struct net *net = dev_net(dev);
>> + struct mpls_dev *mdev;
>> unsigned index;
>>
>> platform_label = rtnl_dereference(net->mpls.platform_label);
>> @@ -455,14 +551,31 @@ static void mpls_ifdown(struct net_device *dev)
>> continue;
>> rt->rt_dev = NULL;
>> }
>> +
>> + mdev = mpls_dev_get(dev);
>> + if (!mdev)
>> + return;
>> +
>> + mpls_dev_sysctl_unregister(mdev);
>> +
>> + RCU_INIT_POINTER(dev->mpls_ptr, NULL);
>> +
>> + kfree(mdev);
>> }
>>
>> static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
>> void *ptr)
>> {
>> struct net_device *dev = netdev_notifier_info_to_dev(ptr);
>> + struct mpls_dev *mdev;
>>
>> switch(event) {
>> + case NETDEV_REGISTER:
>> + mdev = mpls_add_dev(dev);
>> + if (IS_ERR(mdev))
>> + return notifier_from_errno(PTR_ERR(mdev));
>> + break;
>> +
>> case NETDEV_UNREGISTER:
>> mpls_ifdown(dev);
>> break;
>> @@ -924,7 +1037,7 @@ static int mpls_platform_labels(struct ctl_table *table, int write,
>> return ret;
>> }
>>
>> -static struct ctl_table mpls_table[] = {
>> +static const struct ctl_table mpls_table[] = {
>> {
>> .procname = "platform_labels",
>> .data = NULL,
>> diff --git a/net/mpls/internal.h b/net/mpls/internal.h
>> index 5732283..e676a43 100644
>> --- a/net/mpls/internal.h
>> +++ b/net/mpls/internal.h
>> @@ -23,6 +23,12 @@ struct mpls_entry_decoded {
>> u8 bos;
>> };
>>
>> +struct mpls_dev {
>> + int fwd_enabled;
>> +
>> + struct ctl_table_header *sysctl;
>> +};
>> +
>> struct sk_buff;
>>
>> static inline struct mpls_shim_hdr *mpls_hdr(const struct sk_buff *skb)
next prev parent reply other threads:[~2015-03-23 13:10 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-19 21:32 [PATCH net-next 0/5] mpls: Behaviour-changing improvements Robert Shearman
2015-03-19 21:32 ` [PATCH net-next 1/5] mpls: Use definition for reserved label checks Robert Shearman
2015-03-20 0:41 ` Eric W. Biederman
2015-03-20 14:12 ` Robert Shearman
2015-03-19 21:32 ` [PATCH net-next 2/5] mpls: Remove incorrect PHP comment Robert Shearman
2015-03-19 21:32 ` [PATCH net-next 3/5] mpls: Differentiate implicit-null and unlabeled neighbours Robert Shearman
2015-03-19 21:32 ` [PATCH net-next 4/5] mpls: Per-device enabling of packet forwarding Robert Shearman
2015-03-19 21:32 ` [PATCH net-next 5/5] mpls: Allow payload type to be associated with label routes Robert Shearman
2015-03-20 15:42 ` [PATCH net-next v2 0/5] mpls: Behaviour-changing improvements Robert Shearman
2015-03-20 15:42 ` [PATCH net-next v2 1/5] mpls: Use definition for reserved label checks Robert Shearman
2015-03-22 19:09 ` Eric W. Biederman
2015-03-20 15:42 ` [PATCH net-next v2 2/5] mpls: Remove incorrect PHP comment Robert Shearman
2015-03-22 19:12 ` Eric W. Biederman
2015-03-23 11:32 ` Robert Shearman
2015-03-23 18:16 ` Eric W. Biederman
2015-03-24 15:18 ` Robert Shearman
2015-03-24 18:43 ` Vivek Venkatraman
2015-03-20 15:42 ` [PATCH net-next v2 3/5] mpls: Differentiate implicit-null and unlabeled neighbours Robert Shearman
2015-03-22 19:49 ` Eric W. Biederman
2015-03-22 21:06 ` Eric W. Biederman
2015-03-23 11:47 ` Robert Shearman
2015-03-20 15:42 ` [PATCH net-next v2 4/5] mpls: Per-device enabling of packet forwarding Robert Shearman
2015-03-22 20:02 ` Eric W. Biederman
2015-03-22 20:34 ` Eric W. Biederman
2015-03-23 13:42 ` Robert Shearman
2015-03-23 13:10 ` Robert Shearman [this message]
2015-03-20 15:42 ` [PATCH net-next v2 5/5] mpls: Allow payload type to be associated with label routes Robert Shearman
2015-03-22 20:56 ` Eric W. Biederman
2015-03-23 14:02 ` Robert Shearman
2015-03-30 18:15 ` [PATCH net-next v3 0/4] mpls: Behaviour-changing improvements Robert Shearman
2015-03-30 18:15 ` [PATCH net-next v3 1/4] mpls: Use definition for reserved label checks Robert Shearman
2015-03-30 18:15 ` [PATCH net-next v3 2/4] mpls: Differentiate implicit-null and unlabeled neighbours Robert Shearman
2015-04-07 16:56 ` Eric W. Biederman
2015-04-08 17:08 ` Robert Shearman
2015-03-30 18:15 ` [PATCH net-next v3 3/4] mpls: Per-device enabling of packet input Robert Shearman
2015-04-07 17:02 ` Eric W. Biederman
2015-04-08 14:29 ` Robert Shearman
2015-04-08 14:44 ` Eric W. Biederman
2015-03-30 18:15 ` [PATCH net-next v3 4/4] mpls: Allow payload type to be associated with label routes Robert Shearman
2015-04-07 17:19 ` Eric W. Biederman
2015-04-08 14:03 ` Robert Shearman
2015-04-01 19:30 ` [PATCH net-next v3 0/4] mpls: Behaviour-changing improvements David Miller
2015-04-01 21:14 ` Eric W. Biederman
2015-04-01 23:49 ` Robert Shearman
2015-04-06 20:02 ` David Miller
2015-04-14 22:44 ` [PATCH net-next v4 0/6] " Robert Shearman
2015-04-14 22:44 ` [PATCH net-next v4 1/6] mpls: Use definition for reserved label checks Robert Shearman
2015-04-14 22:44 ` [PATCH net-next v4 2/6] mpls: Per-device MPLS state Robert Shearman
2015-04-14 22:45 ` [PATCH net-next v4 3/6] mpls: Per-device enabling of packet input Robert Shearman
2015-04-14 22:45 ` [PATCH net-next v4 4/6] mpls: Allow payload type to be associated with label routes Robert Shearman
2015-04-14 22:45 ` [PATCH net-next v4 5/6] mpls: Differentiate implicit-null and unlabeled neighbours Robert Shearman
2015-04-14 22:45 ` [PATCH net-next v4 6/6] mpls: Prevent use of implicit NULL label as outgoing label Robert Shearman
2015-04-21 20:34 ` [PATCH 0/3] mpls: ABI changes for security and correctness Robert Shearman
2015-04-21 20:34 ` [PATCH 1/3] mpls: Per-device MPLS state Robert Shearman
2015-04-21 20:34 ` [PATCH 2/3] mpls: Per-device enabling of packet input Robert Shearman
2015-04-21 20:34 ` [PATCH 3/3] mpls: Prevent use of implicit NULL label as outgoing label Robert Shearman
2015-04-22 0:29 ` [PATCH 0/3] mpls: ABI changes for security and correctness Eric W. Biederman
2015-04-22 2:12 ` David Miller
2015-04-22 10:10 ` Robert Shearman
2015-04-22 10:14 ` [PATCH v2 " Robert Shearman
2015-04-22 10:14 ` [PATCH v2 1/3] mpls: Per-device MPLS state Robert Shearman
2015-04-22 15:25 ` Eric W. Biederman
2015-04-22 10:14 ` [PATCH v2 2/3] mpls: Per-device enabling of packet input Robert Shearman
2015-04-22 16:27 ` Eric W. Biederman
2015-04-22 10:14 ` [PATCH v2 3/3] mpls: Prevent use of implicit NULL label as outgoing label Robert Shearman
2015-04-22 16:32 ` Eric W. Biederman
2015-04-22 16:47 ` [PATCH v2 0/3] mpls: ABI changes for security and correctness Eric W. Biederman
2015-04-22 18:25 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=551010D6.9050305@brocade.com \
--to=rshearma@brocade$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=ebiederm@xmission$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox