Skip to content

Commit 4a22a73

Browse files
choppsv1choppsv1
committed
patch release: v8
Signed-off-by: Christian Hopps <[email protected]>
1 parent 39eba9a commit 4a22a73

17 files changed

+5383
-0
lines changed

‎patches/v8/v8-0000-cover-letter.patch

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
Subject: [PATCH ipsec-next v8 00/16] Add IP-TFS mode to xfrm
2+
3+
* Summary of Changes:
4+
5+
This patchset adds a new xfrm mode implementing on-demand IP-TFS. IP-TFS
6+
(AggFrag encapsulation) has been standardized in RFC9347.
7+
8+
Link: https://www.rfc-editor.org/rfc/rfc9347.txt
9+
10+
This feature supports demand driven (i.e., non-constant send rate)
11+
IP-TFS to take advantage of the AGGFRAG ESP payload encapsulation. This
12+
payload type supports aggregation and fragmentation of the inner IP
13+
packet stream which in turn yields higher small-packet bandwidth as well
14+
as reducing MTU/PMTU issues. Congestion control is unimplementated as
15+
the send rate is demand driven rather than constant.
16+
17+
In order to allow loading this fucntionality as a module a set of
18+
callbacks xfrm_mode_cbs has been added to xfrm as well.
19+
20+
Patchset Changes:
21+
-----------------
22+
23+
include/net/xfrm.h | 44 +
24+
include/uapi/linux/in.h | 2 +
25+
include/uapi/linux/ip.h | 16 +
26+
include/uapi/linux/ipsec.h | 3 +-
27+
include/uapi/linux/snmp.h | 3 +
28+
include/uapi/linux/xfrm.h | 9 +-
29+
net/ipv4/esp4.c | 3 +-
30+
net/ipv6/esp6.c | 3 +-
31+
net/netfilter/nft_xfrm.c | 3 +-
32+
net/xfrm/Kconfig | 16 +
33+
net/xfrm/Makefile | 1 +
34+
net/xfrm/trace_iptfs.h | 218 ++++
35+
net/xfrm/xfrm_compat.c | 10 +-
36+
net/xfrm/xfrm_device.c | 4 +-
37+
net/xfrm/xfrm_input.c | 18 +-
38+
net/xfrm/xfrm_iptfs.c | 2858 ++++++++++++++++++++++++++++++++++++++++++++
39+
net/xfrm/xfrm_output.c | 6 +
40+
net/xfrm/xfrm_policy.c | 26 +-
41+
net/xfrm/xfrm_proc.c | 3 +
42+
net/xfrm/xfrm_state.c | 84 ++
43+
net/xfrm/xfrm_user.c | 77 ++
44+
21 files changed, 3388 insertions(+), 19 deletions(-)
45+
46+
Patchset Structure:
47+
-------------------
48+
49+
The first 6 commits are changes to the xfrm infrastructure to support
50+
the callbacks as well as more generic IP-TFS additions that may be used
51+
outside the actual IP-TFS implementation.
52+
53+
- xfrm: config: add CONFIG_XFRM_IPTFS
54+
- include: uapi: add ip_tfs_*_hdr packet formats
55+
- include: uapi: add IPPROTO_AGGFRAG for AGGFRAG in ESP
56+
- xfrm: netlink: add config (netlink) options
57+
- xfrm: add mode_cbs module functionality
58+
- xfrm: add generic iptfs defines and functionality
59+
60+
The last 10 commits constitute the IP-TFS implementation constructed in
61+
layers to make review easier. The first 9 commits all apply to a single
62+
file `net/xfrm/xfrm_iptfs.c`, the last commit adds a new tracepoint
63+
header file along with the use of these new tracepoint calls.
64+
65+
- xfrm: iptfs: add new iptfs xfrm mode impl
66+
- xfrm: iptfs: add user packet (tunnel ingress) handling
67+
- xfrm: iptfs: share page fragments of inner packets
68+
- xfrm: iptfs: add fragmenting of larger than MTU user packets
69+
- xfrm: iptfs: add basic receive packet (tunnel egress) handling
70+
- xfrm: iptfs: handle received fragmented inner packets
71+
- xfrm: iptfs: add reusing received skb for the tunnel egress packet
72+
- xfrm: iptfs: add skb-fragment sharing code
73+
- xfrm: iptfs: handle reordering of received packets
74+
- xfrm: iptfs: add tracepoint functionality
75+
76+
Patchset History:
77+
-----------------
78+
79+
RFCv1 (11/10/2023)
80+
81+
RFCv1 -> RFCv2 (11/12/2023)
82+
83+
Updates based on feedback from Simon Horman, Antony,
84+
Michael Richardson, and kernel test robot.
85+
86+
RFCv2 -> v1 (2/19/2024)
87+
88+
Updates based on feedback from Sabrina Dubroca, kernel test robot
89+
90+
v1 -> v2 (5/19/2024)
91+
92+
Updates based on feedback from Sabrina Dubroca, Simon Horman, Antony.
93+
94+
o Add handling of new netlink SA direction attribute (Antony).
95+
o Split single patch/commit of xfrm_iptfs.c (the actual IP-TFS impl)
96+
into 9+1 distinct layered functionality commits for aiding review.
97+
- xfrm: fix return check on clone() callback
98+
- xfrm: add sa_len() callback in xfrm_mode_cbs for copy to user
99+
- iptfs: remove unneeded skb free count variable
100+
- iptfs: remove unused variable and "breadcrumb" for future code.
101+
- iptfs: use do_div() to avoid "__udivd13 missing" link failure.
102+
- iptfs: remove some BUG_ON() assertions questioned in review.
103+
104+
v2->v3
105+
- Git User Glitch
106+
107+
v2->v4 (6/17/2024)
108+
109+
- iptfs: copy only the netlink attributes to user based on the
110+
direction of the SA.
111+
112+
- xfrm: stats: in the output path check for skb->dev == NULL prior to
113+
setting xfrm statistics on dev_net(skb->dev) as skb->dev may be NULL
114+
for locally generated packets.
115+
116+
- xfrm: stats: fix an input use case where dev_net(skb->dev) is used
117+
to inc stats after skb is possibly NULL'd earlier. Switch to using
118+
existing saved `net` pointer.
119+
120+
v4->v5 (7/14/2024)
121+
- uapi: add units to doc comments
122+
- iptfs: add MODULE_DESCRIPTION()
123+
- squash nl-direction-update commit
124+
125+
v5->v6 (7/31/2024)
126+
* sysctl: removed IPTFS sysctl additions
127+
- xfrm: use array of pointers vs structs for mode callbacks
128+
- iptfs: eliminate a memleak during state alloc failure
129+
- iptfs: free send queue content on SA delete
130+
- add some kdoc and comments
131+
- cleanup a couple formatting choices per Steffen
132+
133+
v6->v7 (8/1/2024)
134+
- Rebased on latest ipsec-next
135+
136+
v7->v8 (8/4/2024)
137+
- Use lock and rcu to load iptfs module copy existing use pattern
138+
- fix 2 warnings from the kernel bot

‎patches/v8/v8-0001-xfrm-config-add-CONFIG_XFRM_IPTFS.patch

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
From 0822158912c8e8477b2282ecd6ef406cbf5dcb28 Mon Sep 17 00:00:00 2001
2+
From: Christian Hopps <[email protected]>
3+
Date: Sun, 12 Nov 2023 06:28:49 -0500
4+
Subject: [PATCH ipsec-next v8 01/16] xfrm: config: add CONFIG_XFRM_IPTFS
5+
6+
Add new Kconfig option to enable IP-TFS (RFC9347) functionality.
7+
8+
Signed-off-by: Christian Hopps <[email protected]>
9+
---
10+
net/xfrm/Kconfig | 16 ++++++++++++++++
11+
1 file changed, 16 insertions(+)
12+
13+
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
14+
index d7b16f2c23e9..f0157702718f 100644
15+
--- a/net/xfrm/Kconfig
16+
+++ b/net/xfrm/Kconfig
17+
@@ -135,6 +135,22 @@ config NET_KEY_MIGRATE
18+
19+
If unsure, say N.
20+
21+
+config XFRM_IPTFS
22+
+ tristate "IPsec IP-TFS/AGGFRAG (RFC 9347) encapsulation support"
23+
+ depends on XFRM
24+
+ help
25+
+ Information on the IP-TFS/AGGFRAG encapsulation can be found
26+
+ in RFC 9347. This feature supports demand driven (i.e.,
27+
+ non-constant send rate) IP-TFS to take advantage of the
28+
+ AGGFRAG ESP payload encapsulation. This payload type
29+
+ supports aggregation and fragmentation of the inner IP
30+
+ packet stream which in turn yields higher small-packet
31+
+ bandwidth as well as reducing MTU/PMTU issues. Congestion
32+
+ control is unimplementated as the send rate is demand driven
33+
+ rather than constant.
34+
+
35+
+ If unsure, say N.
36+
+
37+
config XFRM_ESPINTCP
38+
bool
39+
40+
--
41+
2.46.0
42+

‎patches/v8/v8-0002-include-uapi-add-ip_tfs_-_hdr-packet-formats.patch

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 8cba80905abbe7af6ca00618afcd13b3c13a91af Mon Sep 17 00:00:00 2001
2+
From: Christian Hopps <[email protected]>
3+
Date: Wed, 20 Apr 2022 13:15:20 -0400
4+
Subject: [PATCH ipsec-next v8 02/16] include: uapi: add ip_tfs_*_hdr packet
5+
formats
6+
7+
Add the on-wire basic and congestion-control IP-TFS packet headers.
8+
9+
Signed-off-by: Christian Hopps <[email protected]>
10+
---
11+
include/uapi/linux/ip.h | 16 ++++++++++++++++
12+
1 file changed, 16 insertions(+)
13+
14+
diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h
15+
index 283dec7e3645..5bd7ce934d74 100644
16+
--- a/include/uapi/linux/ip.h
17+
+++ b/include/uapi/linux/ip.h
18+
@@ -137,6 +137,22 @@ struct ip_beet_phdr {
19+
__u8 reserved;
20+
};
21+
22+
+struct ip_iptfs_hdr {
23+
+ __u8 subtype; /* 0*: basic, 1: CC */
24+
+ __u8 flags;
25+
+ __be16 block_offset;
26+
+};
27+
+
28+
+struct ip_iptfs_cc_hdr {
29+
+ __u8 subtype; /* 0: basic, 1*: CC */
30+
+ __u8 flags;
31+
+ __be16 block_offset;
32+
+ __be32 loss_rate;
33+
+ __be64 rtt_adelay_xdelay;
34+
+ __be32 tval;
35+
+ __be32 techo;
36+
+};
37+
+
38+
/* index values for the variables in ipv4_devconf */
39+
enum
40+
{
41+
--
42+
2.46.0
43+

‎patches/v8/v8-0003-include-uapi-add-IPPROTO_AGGFRAG-for-AGGFRAG-in-E.patch

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
From 93deaa06aefbdf1f581f9956c27e3e765671dea3 Mon Sep 17 00:00:00 2001
2+
From: Christian Hopps <[email protected]>
3+
Date: Sat, 27 Aug 2022 02:26:52 +0000
4+
Subject: [PATCH ipsec-next v8 03/16] include: uapi: add IPPROTO_AGGFRAG for
5+
AGGFRAG in ESP
6+
7+
Add the RFC assigned IP protocol number for AGGFRAG.
8+
9+
Signed-off-by: Christian Hopps <[email protected]>
10+
---
11+
include/uapi/linux/in.h | 2 ++
12+
1 file changed, 2 insertions(+)
13+
14+
diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
15+
index d358add1611c..268086e85d04 100644
16+
--- a/include/uapi/linux/in.h
17+
+++ b/include/uapi/linux/in.h
18+
@@ -79,6 +79,8 @@ enum {
19+
#define IPPROTO_MPLS IPPROTO_MPLS
20+
IPPROTO_ETHERNET = 143, /* Ethernet-within-IPv6 Encapsulation */
21+
#define IPPROTO_ETHERNET IPPROTO_ETHERNET
22+
+ IPPROTO_AGGFRAG = 144, /* AGGFRAG in ESP (RFC 9347) */
23+
+#define IPPROTO_AGGFRAG IPPROTO_AGGFRAG
24+
IPPROTO_RAW = 255, /* Raw IP packets */
25+
#define IPPROTO_RAW IPPROTO_RAW
26+
IPPROTO_SMC = 256, /* Shared Memory Communications */
27+
--
28+
2.46.0
29+

0 commit comments

Comments
 (0)