License cleanup: add SPDX GPL-2.0 license identifier to files with no license
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.
By default all files without license information are under the default
license of the kernel, which is GPL version 2.
Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier. The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.
This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.
How this work was done:
Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
- file had no licensing information it it.
- file was a */uapi/* one with no licensing information in it,
- file was a */uapi/* one with existing licensing information,
Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.
The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne. Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.
The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed. Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.
Criteria used to select files for SPDX license identifier tagging was:
- Files considered eligible had to be source code files.
- Make and config files were included as candidates if they contained >5
lines of source
- File already had some variant of a license header in it (even if <5
lines).
All documentation files were explicitly excluded.
The following heuristics were used to determine which SPDX license
identifiers to apply.
- when both scanners couldn't find any license traces, file was
considered to have no license information in it, and the top level
COPYING file license applied.
For non */uapi/* files that summary was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 11139
and resulted in the first patch in this series.
If that file was a */uapi/* path one, it was "GPL-2.0 WITH
Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 WITH Linux-syscall-note 930
and resulted in the second patch in this series.
- if a file had some form of licensing information in it, and was one
of the */uapi/* ones, it was denoted with the Linux-syscall-note if
any GPL family license was found in the file or had no licensing in
it (per prior point). Results summary:
SPDX license identifier # files
---------------------------------------------------|------
GPL-2.0 WITH Linux-syscall-note 270
GPL-2.0+ WITH Linux-syscall-note 169
((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21
((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17
LGPL-2.1+ WITH Linux-syscall-note 15
GPL-1.0+ WITH Linux-syscall-note 14
((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5
LGPL-2.0+ WITH Linux-syscall-note 4
LGPL-2.1 WITH Linux-syscall-note 3
((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3
((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1
and that resulted in the third patch in this series.
- when the two scanners agreed on the detected license(s), that became
the concluded license(s).
- when there was disagreement between the two scanners (one detected a
license but the other didn't, or they both detected different
licenses) a manual inspection of the file occurred.
- In most cases a manual inspection of the information in the file
resulted in a clear resolution of the license that should apply (and
which scanner probably needed to revisit its heuristics).
- When it was not immediately clear, the license identifier was
confirmed with lawyers working with the Linux Foundation.
- If there was any question as to the appropriate license identifier,
the file was flagged for further research and to be revisited later
in time.
In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.
Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights. The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.
Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.
In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.
Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
- a full scancode scan run, collecting the matched texts, detected
license ids and scores
- reviewing anything where there was a license detected (about 500+
files) to ensure that the applied SPDX license was correct
- reviewing anything where there was no detection but the patch license
was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
SPDX license was correct
This produced a worksheet with 20 files needing minor correction. This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.
These .csv files were then reviewed by Greg. Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected. This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.) Finally Greg ran the script using the .csv files to
generate the patches.
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 22:07:57 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
2007-02-09 22:24:47 +08:00
|
|
|
/*
|
2005-04-17 06:20:36 +08:00
|
|
|
* xfrm4_policy.c
|
|
|
|
|
*
|
|
|
|
|
* Changes:
|
|
|
|
|
* Kazunori MIYAZAWA @USAGI
|
|
|
|
|
* YOSHIFUJI Hideaki @USAGI
|
|
|
|
|
* Split up af-specific portion
|
2007-02-09 22:24:47 +08:00
|
|
|
*
|
2005-04-17 06:20:36 +08:00
|
|
|
*/
|
|
|
|
|
|
2007-11-14 13:37:28 +08:00
|
|
|
#include <linux/err.h>
|
|
|
|
|
#include <linux/kernel.h>
|
2005-05-04 07:27:10 +08:00
|
|
|
#include <linux/inetdevice.h>
|
2010-11-03 12:41:38 +08:00
|
|
|
#include <linux/if_tunnel.h>
|
2007-11-14 13:35:32 +08:00
|
|
|
#include <net/dst.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <net/xfrm.h>
|
|
|
|
|
#include <net/ip.h>
|
2015-09-30 11:07:13 +08:00
|
|
|
#include <net/l3mdev.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-05-10 06:13:28 +08:00
|
|
|
static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
|
2015-08-11 06:58:11 +08:00
|
|
|
int tos, int oif,
|
2011-05-10 06:13:28 +08:00
|
|
|
const xfrm_address_t *saddr,
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
const xfrm_address_t *daddr,
|
|
|
|
|
u32 mark)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2007-11-14 13:37:28 +08:00
|
|
|
struct rtable *rt;
|
2006-09-20 03:57:34 +08:00
|
|
|
|
2011-05-10 06:13:28 +08:00
|
|
|
memset(fl4, 0, sizeof(*fl4));
|
|
|
|
|
fl4->daddr = daddr->a4;
|
|
|
|
|
fl4->flowi4_tos = tos;
|
2016-08-15 10:52:56 +08:00
|
|
|
fl4->flowi4_oif = l3mdev_master_ifindex_by_index(net, oif);
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
fl4->flowi4_mark = mark;
|
2007-11-14 13:37:28 +08:00
|
|
|
if (saddr)
|
2011-05-10 06:13:28 +08:00
|
|
|
fl4->saddr = saddr->a4;
|
2007-11-14 13:37:28 +08:00
|
|
|
|
2015-09-16 06:10:50 +08:00
|
|
|
fl4->flowi4_flags = FLOWI_FLAG_SKIP_NH_OIF;
|
|
|
|
|
|
2011-05-10 06:13:28 +08:00
|
|
|
rt = __ip_route_output_key(net, fl4);
|
2011-03-03 06:31:35 +08:00
|
|
|
if (!IS_ERR(rt))
|
|
|
|
|
return &rt->dst;
|
|
|
|
|
|
|
|
|
|
return ERR_CAST(rt);
|
2007-11-14 13:37:28 +08:00
|
|
|
}
|
|
|
|
|
|
2015-08-11 06:58:11 +08:00
|
|
|
static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif,
|
2011-05-10 06:13:28 +08:00
|
|
|
const xfrm_address_t *saddr,
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
const xfrm_address_t *daddr,
|
|
|
|
|
u32 mark)
|
2011-05-10 06:13:28 +08:00
|
|
|
{
|
|
|
|
|
struct flowi4 fl4;
|
|
|
|
|
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark);
|
2011-05-10 06:13:28 +08:00
|
|
|
}
|
|
|
|
|
|
2015-08-11 06:58:11 +08:00
|
|
|
static int xfrm4_get_saddr(struct net *net, int oif,
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
xfrm_address_t *saddr, xfrm_address_t *daddr,
|
|
|
|
|
u32 mark)
|
2007-11-14 13:37:28 +08:00
|
|
|
{
|
|
|
|
|
struct dst_entry *dst;
|
2011-05-10 06:13:28 +08:00
|
|
|
struct flowi4 fl4;
|
2007-11-14 13:37:28 +08:00
|
|
|
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 01:11:33 +08:00
|
|
|
dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr, mark);
|
2007-11-14 13:37:28 +08:00
|
|
|
if (IS_ERR(dst))
|
|
|
|
|
return -EHOSTUNREACH;
|
|
|
|
|
|
2011-05-10 06:13:28 +08:00
|
|
|
saddr->a4 = fl4.saddr;
|
2007-11-14 13:37:28 +08:00
|
|
|
dst_release(dst);
|
|
|
|
|
return 0;
|
2006-09-20 03:57:34 +08:00
|
|
|
}
|
|
|
|
|
|
2011-02-23 09:47:10 +08:00
|
|
|
static int xfrm4_get_tos(const struct flowi *fl)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2011-03-12 15:42:11 +08:00
|
|
|
return IPTOS_RT_MASK & fl->u.ip4.flowi4_tos; /* Strip ECN bits */
|
2007-12-12 01:32:34 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2007-12-21 12:41:12 +08:00
|
|
|
static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
|
|
|
|
|
int nfheader_len)
|
|
|
|
|
{
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2010-03-02 10:51:56 +08:00
|
|
|
static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
|
2011-02-23 09:48:57 +08:00
|
|
|
const struct flowi *fl)
|
2007-12-12 01:32:34 +08:00
|
|
|
{
|
|
|
|
|
struct rtable *rt = (struct rtable *)xdst->route;
|
2011-03-12 15:42:11 +08:00
|
|
|
const struct flowi4 *fl4 = &fl->u.ip4;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-10-23 05:58:20 +08:00
|
|
|
xdst->u.rt.rt_iif = fl4->flowi4_iif;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2007-12-12 01:32:34 +08:00
|
|
|
xdst->u.dst.dev = dev;
|
|
|
|
|
dev_hold(dev);
|
2007-02-07 06:27:32 +08:00
|
|
|
|
2007-12-12 01:32:34 +08:00
|
|
|
/* Sheit... I remember I did this right. Apparently,
|
|
|
|
|
* it was magically lost, so this code needs audit */
|
2012-07-18 05:44:26 +08:00
|
|
|
xdst->u.rt.rt_is_input = rt->rt_is_input;
|
2007-12-12 01:32:34 +08:00
|
|
|
xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST |
|
|
|
|
|
RTCF_LOCAL);
|
|
|
|
|
xdst->u.rt.rt_type = rt->rt_type;
|
|
|
|
|
xdst->u.rt.rt_gateway = rt->rt_gateway;
|
2012-10-08 19:41:18 +08:00
|
|
|
xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
|
2012-07-10 21:58:42 +08:00
|
|
|
xdst->u.rt.rt_pmtu = rt->rt_pmtu;
|
2012-08-01 06:06:50 +08:00
|
|
|
INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
2007-12-13 02:44:16 +08:00
|
|
|
_decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2011-04-22 12:53:02 +08:00
|
|
|
const struct iphdr *iph = ip_hdr(skb);
|
2007-04-11 11:50:43 +08:00
|
|
|
u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
|
2011-03-12 15:42:11 +08:00
|
|
|
struct flowi4 *fl4 = &fl->u.ip4;
|
2013-10-30 18:16:28 +08:00
|
|
|
int oif = 0;
|
|
|
|
|
|
2015-09-30 11:07:13 +08:00
|
|
|
if (skb_dst(skb))
|
2016-09-11 03:09:57 +08:00
|
|
|
oif = skb_dst(skb)->dev->ifindex;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 15:42:11 +08:00
|
|
|
memset(fl4, 0, sizeof(struct flowi4));
|
|
|
|
|
fl4->flowi4_mark = skb->mark;
|
2013-10-30 18:16:28 +08:00
|
|
|
fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
|
2010-07-02 15:47:55 +08:00
|
|
|
|
2011-06-22 11:33:34 +08:00
|
|
|
if (!ip_is_fragment(iph)) {
|
2005-04-17 06:20:36 +08:00
|
|
|
switch (iph->protocol) {
|
|
|
|
|
case IPPROTO_UDP:
|
2006-11-28 03:10:57 +08:00
|
|
|
case IPPROTO_UDPLITE:
|
2005-04-17 06:20:36 +08:00
|
|
|
case IPPROTO_TCP:
|
|
|
|
|
case IPPROTO_SCTP:
|
2005-12-20 06:03:46 +08:00
|
|
|
case IPPROTO_DCCP:
|
2009-07-03 00:57:23 +08:00
|
|
|
if (xprth + 4 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
__be16 *ports;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
ports = (__be16 *)xprth;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_sport = ports[!!reverse];
|
|
|
|
|
fl4->fl4_dport = ports[!reverse];
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case IPPROTO_ICMP:
|
2015-10-23 13:31:23 +08:00
|
|
|
if (xprth + 2 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 2 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
u8 *icmp;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
icmp = xprth;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_icmp_type = icmp[0];
|
|
|
|
|
fl4->fl4_icmp_code = icmp[1];
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case IPPROTO_ESP:
|
2015-10-23 13:31:23 +08:00
|
|
|
if (xprth + 4 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
__be32 *ehdr;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
ehdr = (__be32 *)xprth;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_ipsec_spi = ehdr[0];
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case IPPROTO_AH:
|
2015-10-23 13:31:23 +08:00
|
|
|
if (xprth + 8 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 8 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
__be32 *ah_hdr;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
ah_hdr = (__be32 *)xprth;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_ipsec_spi = ah_hdr[1];
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case IPPROTO_COMP:
|
2015-10-23 13:31:23 +08:00
|
|
|
if (xprth + 4 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
__be16 *ipcomp_hdr;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
ipcomp_hdr = (__be16 *)xprth;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
break;
|
2010-11-03 12:41:38 +08:00
|
|
|
|
|
|
|
|
case IPPROTO_GRE:
|
2015-10-23 13:31:23 +08:00
|
|
|
if (xprth + 12 < skb->data ||
|
|
|
|
|
pskb_may_pull(skb, xprth + 12 - skb->data)) {
|
2015-10-23 13:32:39 +08:00
|
|
|
__be16 *greflags;
|
|
|
|
|
__be32 *gre_hdr;
|
|
|
|
|
|
|
|
|
|
xprth = skb_network_header(skb) + iph->ihl * 4;
|
|
|
|
|
greflags = (__be16 *)xprth;
|
|
|
|
|
gre_hdr = (__be32 *)xprth;
|
2010-11-03 12:41:38 +08:00
|
|
|
|
|
|
|
|
if (greflags[0] & GRE_KEY) {
|
|
|
|
|
if (greflags[0] & GRE_CSUM)
|
|
|
|
|
gre_hdr++;
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_gre_key = gre_hdr[1];
|
2010-11-03 12:41:38 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
default:
|
2011-03-12 16:00:33 +08:00
|
|
|
fl4->fl4_ipsec_spi = 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
break;
|
2007-04-21 08:09:22 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
2011-03-12 15:42:11 +08:00
|
|
|
fl4->flowi4_proto = iph->protocol;
|
|
|
|
|
fl4->daddr = reverse ? iph->saddr : iph->daddr;
|
|
|
|
|
fl4->saddr = reverse ? iph->daddr : iph->saddr;
|
|
|
|
|
fl4->flowi4_tos = iph->tos;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2012-07-17 18:29:28 +08:00
|
|
|
static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb, u32 mtu)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
|
2012-07-17 18:29:28 +08:00
|
|
|
path->ops->update_pmtu(path, sk, skb, mtu);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2012-07-17 18:29:28 +08:00
|
|
|
static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
2012-07-12 12:27:49 +08:00
|
|
|
{
|
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
|
2012-07-17 18:29:28 +08:00
|
|
|
path->ops->redirect(path, sk, skb);
|
2012-07-12 12:27:49 +08:00
|
|
|
}
|
|
|
|
|
|
2005-05-04 07:27:10 +08:00
|
|
|
static void xfrm4_dst_destroy(struct dst_entry *dst)
|
|
|
|
|
{
|
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
|
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-27 12:51:05 +08:00
|
|
|
dst_destroy_metrics_generic(dst);
|
|
|
|
|
|
2005-05-04 07:27:10 +08:00
|
|
|
xfrm_dst_destroy(xdst);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
|
|
|
|
|
int unregister)
|
|
|
|
|
{
|
|
|
|
|
if (!unregister)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
xfrm_dst_ifdown(dst, dev);
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-29 21:51:16 +08:00
|
|
|
static struct dst_ops xfrm4_dst_ops_template = {
|
2005-04-17 06:20:36 +08:00
|
|
|
.family = AF_INET,
|
|
|
|
|
.update_pmtu = xfrm4_update_pmtu,
|
2012-07-12 12:27:49 +08:00
|
|
|
.redirect = xfrm4_redirect,
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-27 12:51:05 +08:00
|
|
|
.cow_metrics = dst_cow_metrics_generic,
|
2005-05-04 07:27:10 +08:00
|
|
|
.destroy = xfrm4_dst_destroy,
|
|
|
|
|
.ifdown = xfrm4_dst_ifdown,
|
2007-11-14 13:43:11 +08:00
|
|
|
.local_out = __ip_local_out,
|
2017-07-17 19:57:20 +08:00
|
|
|
.gc_thresh = 32768,
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
2017-02-07 22:00:19 +08:00
|
|
|
static const struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
|
2015-10-29 21:51:16 +08:00
|
|
|
.dst_ops = &xfrm4_dst_ops_template,
|
2005-04-17 06:20:36 +08:00
|
|
|
.dst_lookup = xfrm4_dst_lookup,
|
2006-09-20 03:57:34 +08:00
|
|
|
.get_saddr = xfrm4_get_saddr,
|
2005-04-17 06:20:36 +08:00
|
|
|
.decode_session = _decode_session4,
|
2007-12-12 01:32:34 +08:00
|
|
|
.get_tos = xfrm4_get_tos,
|
2007-12-21 12:41:12 +08:00
|
|
|
.init_path = xfrm4_init_path,
|
2007-12-12 01:32:34 +08:00
|
|
|
.fill_dst = xfrm4_fill_dst,
|
2011-03-02 06:59:04 +08:00
|
|
|
.blackhole_route = ipv4_blackhole_route,
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
2009-08-05 11:18:33 +08:00
|
|
|
#ifdef CONFIG_SYSCTL
|
2009-07-27 16:22:46 +08:00
|
|
|
static struct ctl_table xfrm4_policy_table[] = {
|
|
|
|
|
{
|
|
|
|
|
.procname = "xfrm4_gc_thresh",
|
2010-01-25 14:47:53 +08:00
|
|
|
.data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
|
2009-07-27 16:22:46 +08:00
|
|
|
.maxlen = sizeof(int),
|
|
|
|
|
.mode = 0644,
|
|
|
|
|
.proc_handler = proc_dointvec,
|
|
|
|
|
},
|
|
|
|
|
{ }
|
|
|
|
|
};
|
|
|
|
|
|
2016-06-16 21:59:25 +08:00
|
|
|
static __net_init int xfrm4_net_sysctl_init(struct net *net)
|
2013-02-06 17:46:33 +08:00
|
|
|
{
|
|
|
|
|
struct ctl_table *table;
|
|
|
|
|
struct ctl_table_header *hdr;
|
|
|
|
|
|
|
|
|
|
table = xfrm4_policy_table;
|
|
|
|
|
if (!net_eq(net, &init_net)) {
|
|
|
|
|
table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
|
|
|
|
|
if (!table)
|
|
|
|
|
goto err_alloc;
|
|
|
|
|
|
|
|
|
|
table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
hdr = register_net_sysctl(net, "net/ipv4", table);
|
|
|
|
|
if (!hdr)
|
|
|
|
|
goto err_reg;
|
|
|
|
|
|
|
|
|
|
net->ipv4.xfrm4_hdr = hdr;
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
err_reg:
|
|
|
|
|
if (!net_eq(net, &init_net))
|
|
|
|
|
kfree(table);
|
|
|
|
|
err_alloc:
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-16 21:59:25 +08:00
|
|
|
static __net_exit void xfrm4_net_sysctl_exit(struct net *net)
|
2013-02-06 17:46:33 +08:00
|
|
|
{
|
|
|
|
|
struct ctl_table *table;
|
|
|
|
|
|
2015-04-03 16:17:26 +08:00
|
|
|
if (!net->ipv4.xfrm4_hdr)
|
2013-02-06 17:46:33 +08:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
table = net->ipv4.xfrm4_hdr->ctl_table_arg;
|
|
|
|
|
unregister_net_sysctl_table(net->ipv4.xfrm4_hdr);
|
|
|
|
|
if (!net_eq(net, &init_net))
|
|
|
|
|
kfree(table);
|
|
|
|
|
}
|
2015-10-29 21:51:16 +08:00
|
|
|
#else /* CONFIG_SYSCTL */
|
2016-06-16 21:59:25 +08:00
|
|
|
static inline int xfrm4_net_sysctl_init(struct net *net)
|
2015-10-29 21:51:16 +08:00
|
|
|
{
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-16 21:59:25 +08:00
|
|
|
static inline void xfrm4_net_sysctl_exit(struct net *net)
|
2015-10-29 21:51:16 +08:00
|
|
|
{
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
static int __net_init xfrm4_net_init(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
memcpy(&net->xfrm.xfrm4_dst_ops, &xfrm4_dst_ops_template,
|
|
|
|
|
sizeof(xfrm4_dst_ops_template));
|
|
|
|
|
ret = dst_entries_init(&net->xfrm.xfrm4_dst_ops);
|
|
|
|
|
if (ret)
|
|
|
|
|
return ret;
|
|
|
|
|
|
|
|
|
|
ret = xfrm4_net_sysctl_init(net);
|
|
|
|
|
if (ret)
|
|
|
|
|
dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void __net_exit xfrm4_net_exit(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
xfrm4_net_sysctl_exit(net);
|
|
|
|
|
dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
|
|
|
|
|
}
|
2013-02-06 17:46:33 +08:00
|
|
|
|
|
|
|
|
static struct pernet_operations __net_initdata xfrm4_net_ops = {
|
|
|
|
|
.init = xfrm4_net_init,
|
|
|
|
|
.exit = xfrm4_net_exit,
|
net: Convert pernet_subsys, registered from inet_init()
arp_net_ops just addr/removes /proc entry.
devinet_ops allocates and frees duplicate of init_net tables
and (un)registers sysctl entries.
fib_net_ops allocates and frees pernet tables, creates/destroys
netlink socket and (un)initializes /proc entries. Foreign
pernet_operations do not touch them.
ip_rt_proc_ops only modifies pernet /proc entries.
xfrm_net_ops creates/destroys /proc entries, allocates/frees
pernet statistics, hashes and tables, and (un)initializes
sysctl files. These are not touched by foreigh pernet_operations
xfrm4_net_ops allocates/frees private pernet memory, and
configures sysctls.
sysctl_route_ops creates/destroys sysctls.
rt_genid_ops only initializes fields of just allocated net.
ipv4_inetpeer_ops allocated/frees net private memory.
igmp_net_ops just creates/destroys /proc files and socket,
noone else interested in.
tcp_sk_ops seems to be safe, because tcp_sk_init() does not
depend on any other pernet_operations modifications. Iteration
over hash table in inet_twsk_purge() is made under RCU lock,
and it's safe to iterate the table this way. Removing from
the table happen from inet_twsk_deschedule_put(), but this
function is safe without any extern locks, as it's synchronized
inside itself. There are many examples, it's used in different
context. So, it's safe to leave tcp_sk_exit_batch() unlocked.
tcp_net_metrics_ops is synchronized on tcp_metrics_lock and safe.
udplite4_net_ops only creates/destroys pernet /proc file.
icmp_sk_ops creates percpu sockets, not touched by foreign
pernet_operations.
ipmr_net_ops creates/destroys pernet fib tables, (un)registers
fib rules and /proc files. This seem to be safe to execute
in parallel with foreign pernet_operations.
af_inet_ops just sets up default parameters of newly created net.
ipv4_mib_ops creates and destroys pernet percpu statistics.
raw_net_ops, tcp4_net_ops, udp4_net_ops, ping_v4_net_ops
and ip_proc_ops only create/destroy pernet /proc files.
ip4_frags_ops creates and destroys sysctl file.
So, it's safe to make the pernet_operations async.
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-13 17:29:52 +08:00
|
|
|
.async = true,
|
2013-02-06 17:46:33 +08:00
|
|
|
};
|
2009-07-27 16:22:46 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
static void __init xfrm4_policy_init(void)
|
|
|
|
|
{
|
2017-02-07 22:00:17 +08:00
|
|
|
xfrm_policy_register_afinfo(&xfrm4_policy_afinfo, AF_INET);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2012-11-13 15:52:24 +08:00
|
|
|
void __init xfrm4_init(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2010-01-25 14:47:53 +08:00
|
|
|
xfrm4_state_init();
|
|
|
|
|
xfrm4_policy_init();
|
2014-03-14 14:28:07 +08:00
|
|
|
xfrm4_protocol_init();
|
2013-02-06 17:46:33 +08:00
|
|
|
register_pernet_subsys(&xfrm4_net_ops);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
