tcp/udp: Make early_demux back namespacified.
commit 11052589cf5c0bab3b4884d423d5f60c38fcf25d upstream. Commite21145a987
("ipv4: namespacify ip_early_demux sysctl knob") made it possible to enable/disable early_demux on a per-netns basis. Then, we introduced two knobs, tcp_early_demux and udp_early_demux, to switch it for TCP/UDP in commitdddb64bcb3
("net: Add sysctl to toggle early demux for tcp and udp"). However, the .proc_handler() was wrong and actually disabled us from changing the behaviour in each netns. We can execute early_demux if net.ipv4.ip_early_demux is on and each proto .early_demux() handler is not NULL. When we toggle (tcp|udp)_early_demux, the change itself is saved in each netns variable, but the .early_demux() handler is a global variable, so the handler is switched based on the init_net's sysctl variable. Thus, netns (tcp|udp)_early_demux knobs have nothing to do with the logic. Whether we CAN execute proto .early_demux() is always decided by init_net's sysctl knob, and whether we DO it or not is by each netns ip_early_demux knob. This patch namespacifies (tcp|udp)_early_demux again. For now, the users of the .early_demux() handler are TCP and UDP only, and they are called directly to avoid retpoline. So, we can remove the .early_demux() handler from inet6?_protos and need not dereference them in ip6?_rcv_finish_core(). If another proto needs .early_demux(), we can restore it at that time. Fixes:dddb64bcb3
("net: Add sysctl to toggle early demux for tcp and udp") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20220713175207.7727-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
febaa6aa64
commit
7162f05f1f
@ -39,8 +39,6 @@
|
|||||||
|
|
||||||
/* This is used to register protocols. */
|
/* This is used to register protocols. */
|
||||||
struct net_protocol {
|
struct net_protocol {
|
||||||
int (*early_demux)(struct sk_buff *skb);
|
|
||||||
int (*early_demux_handler)(struct sk_buff *skb);
|
|
||||||
int (*handler)(struct sk_buff *skb);
|
int (*handler)(struct sk_buff *skb);
|
||||||
void (*err_handler)(struct sk_buff *skb, u32 info);
|
void (*err_handler)(struct sk_buff *skb, u32 info);
|
||||||
unsigned int no_policy:1,
|
unsigned int no_policy:1,
|
||||||
@ -54,8 +52,6 @@ struct net_protocol {
|
|||||||
|
|
||||||
#if IS_ENABLED(CONFIG_IPV6)
|
#if IS_ENABLED(CONFIG_IPV6)
|
||||||
struct inet6_protocol {
|
struct inet6_protocol {
|
||||||
void (*early_demux)(struct sk_buff *skb);
|
|
||||||
void (*early_demux_handler)(struct sk_buff *skb);
|
|
||||||
int (*handler)(struct sk_buff *skb);
|
int (*handler)(struct sk_buff *skb);
|
||||||
|
|
||||||
void (*err_handler)(struct sk_buff *skb,
|
void (*err_handler)(struct sk_buff *skb,
|
||||||
|
@ -901,6 +901,8 @@ static inline int tcp_v6_sdif(const struct sk_buff *skb)
|
|||||||
#endif
|
#endif
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void tcp_v6_early_demux(struct sk_buff *skb);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
|
static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
|
||||||
|
@ -173,6 +173,7 @@ typedef struct sock *(*udp_lookup_t)(struct sk_buff *skb, __be16 sport,
|
|||||||
struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
|
struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
|
||||||
struct udphdr *uh, udp_lookup_t lookup);
|
struct udphdr *uh, udp_lookup_t lookup);
|
||||||
int udp_gro_complete(struct sk_buff *skb, int nhoff, udp_lookup_t lookup);
|
int udp_gro_complete(struct sk_buff *skb, int nhoff, udp_lookup_t lookup);
|
||||||
|
void udp_v6_early_demux(struct sk_buff *skb);
|
||||||
|
|
||||||
struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
|
struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
|
||||||
netdev_features_t features);
|
netdev_features_t features);
|
||||||
|
@ -1678,12 +1678,7 @@ static const struct net_protocol igmp_protocol = {
|
|||||||
};
|
};
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
/* thinking of making this const? Don't.
|
static const struct net_protocol tcp_protocol = {
|
||||||
* early_demux can change based on sysctl.
|
|
||||||
*/
|
|
||||||
static struct net_protocol tcp_protocol = {
|
|
||||||
.early_demux = tcp_v4_early_demux,
|
|
||||||
.early_demux_handler = tcp_v4_early_demux,
|
|
||||||
.handler = tcp_v4_rcv,
|
.handler = tcp_v4_rcv,
|
||||||
.err_handler = tcp_v4_err,
|
.err_handler = tcp_v4_err,
|
||||||
.no_policy = 1,
|
.no_policy = 1,
|
||||||
@ -1691,12 +1686,7 @@ static struct net_protocol tcp_protocol = {
|
|||||||
.icmp_strict_tag_validation = 1,
|
.icmp_strict_tag_validation = 1,
|
||||||
};
|
};
|
||||||
|
|
||||||
/* thinking of making this const? Don't.
|
static const struct net_protocol udp_protocol = {
|
||||||
* early_demux can change based on sysctl.
|
|
||||||
*/
|
|
||||||
static struct net_protocol udp_protocol = {
|
|
||||||
.early_demux = udp_v4_early_demux,
|
|
||||||
.early_demux_handler = udp_v4_early_demux,
|
|
||||||
.handler = udp_rcv,
|
.handler = udp_rcv,
|
||||||
.err_handler = udp_err,
|
.err_handler = udp_err,
|
||||||
.no_policy = 1,
|
.no_policy = 1,
|
||||||
|
@ -306,28 +306,38 @@ drop:
|
|||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
int udp_v4_early_demux(struct sk_buff *);
|
||||||
|
int tcp_v4_early_demux(struct sk_buff *);
|
||||||
static int ip_rcv_finish_core(struct net *net, struct sock *sk,
|
static int ip_rcv_finish_core(struct net *net, struct sock *sk,
|
||||||
struct sk_buff *skb, struct net_device *dev)
|
struct sk_buff *skb, struct net_device *dev)
|
||||||
{
|
{
|
||||||
const struct iphdr *iph = ip_hdr(skb);
|
const struct iphdr *iph = ip_hdr(skb);
|
||||||
int (*edemux)(struct sk_buff *skb);
|
|
||||||
struct rtable *rt;
|
struct rtable *rt;
|
||||||
int err;
|
int err;
|
||||||
|
|
||||||
if (net->ipv4.sysctl_ip_early_demux &&
|
if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
|
||||||
!skb_dst(skb) &&
|
!skb_dst(skb) &&
|
||||||
!skb->sk &&
|
!skb->sk &&
|
||||||
!ip_is_fragment(iph)) {
|
!ip_is_fragment(iph)) {
|
||||||
const struct net_protocol *ipprot;
|
switch (iph->protocol) {
|
||||||
int protocol = iph->protocol;
|
case IPPROTO_TCP:
|
||||||
|
if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux)) {
|
||||||
|
tcp_v4_early_demux(skb);
|
||||||
|
|
||||||
ipprot = rcu_dereference(inet_protos[protocol]);
|
/* must reload iph, skb->head might have changed */
|
||||||
if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) {
|
iph = ip_hdr(skb);
|
||||||
err = edemux(skb);
|
}
|
||||||
if (unlikely(err))
|
break;
|
||||||
goto drop_error;
|
case IPPROTO_UDP:
|
||||||
/* must reload iph, skb->head might have changed */
|
if (READ_ONCE(net->ipv4.sysctl_udp_early_demux)) {
|
||||||
iph = ip_hdr(skb);
|
err = udp_v4_early_demux(skb);
|
||||||
|
if (unlikely(err))
|
||||||
|
goto drop_error;
|
||||||
|
|
||||||
|
/* must reload iph, skb->head might have changed */
|
||||||
|
iph = ip_hdr(skb);
|
||||||
|
}
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -332,61 +332,6 @@ bad_key:
|
|||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void proc_configure_early_demux(int enabled, int protocol)
|
|
||||||
{
|
|
||||||
struct net_protocol *ipprot;
|
|
||||||
#if IS_ENABLED(CONFIG_IPV6)
|
|
||||||
struct inet6_protocol *ip6prot;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
rcu_read_lock();
|
|
||||||
|
|
||||||
ipprot = rcu_dereference(inet_protos[protocol]);
|
|
||||||
if (ipprot)
|
|
||||||
ipprot->early_demux = enabled ? ipprot->early_demux_handler :
|
|
||||||
NULL;
|
|
||||||
|
|
||||||
#if IS_ENABLED(CONFIG_IPV6)
|
|
||||||
ip6prot = rcu_dereference(inet6_protos[protocol]);
|
|
||||||
if (ip6prot)
|
|
||||||
ip6prot->early_demux = enabled ? ip6prot->early_demux_handler :
|
|
||||||
NULL;
|
|
||||||
#endif
|
|
||||||
rcu_read_unlock();
|
|
||||||
}
|
|
||||||
|
|
||||||
static int proc_tcp_early_demux(struct ctl_table *table, int write,
|
|
||||||
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
||||||
{
|
|
||||||
int ret = 0;
|
|
||||||
|
|
||||||
ret = proc_dointvec(table, write, buffer, lenp, ppos);
|
|
||||||
|
|
||||||
if (write && !ret) {
|
|
||||||
int enabled = init_net.ipv4.sysctl_tcp_early_demux;
|
|
||||||
|
|
||||||
proc_configure_early_demux(enabled, IPPROTO_TCP);
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int proc_udp_early_demux(struct ctl_table *table, int write,
|
|
||||||
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
||||||
{
|
|
||||||
int ret = 0;
|
|
||||||
|
|
||||||
ret = proc_dointvec(table, write, buffer, lenp, ppos);
|
|
||||||
|
|
||||||
if (write && !ret) {
|
|
||||||
int enabled = init_net.ipv4.sysctl_udp_early_demux;
|
|
||||||
|
|
||||||
proc_configure_early_demux(enabled, IPPROTO_UDP);
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
|
static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
|
||||||
int write,
|
int write,
|
||||||
void __user *buffer,
|
void __user *buffer,
|
||||||
@ -638,14 +583,14 @@ static struct ctl_table ipv4_net_table[] = {
|
|||||||
.data = &init_net.ipv4.sysctl_udp_early_demux,
|
.data = &init_net.ipv4.sysctl_udp_early_demux,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_udp_early_demux
|
.proc_handler = proc_douintvec_minmax,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "tcp_early_demux",
|
.procname = "tcp_early_demux",
|
||||||
.data = &init_net.ipv4.sysctl_tcp_early_demux,
|
.data = &init_net.ipv4.sysctl_tcp_early_demux,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_tcp_early_demux
|
.proc_handler = proc_douintvec_minmax,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ip_default_ttl",
|
.procname = "ip_default_ttl",
|
||||||
|
@ -47,18 +47,25 @@
|
|||||||
#include <net/inet_ecn.h>
|
#include <net/inet_ecn.h>
|
||||||
#include <net/dst_metadata.h>
|
#include <net/dst_metadata.h>
|
||||||
|
|
||||||
|
void udp_v6_early_demux(struct sk_buff *);
|
||||||
|
void tcp_v6_early_demux(struct sk_buff *);
|
||||||
static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
|
static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
|
||||||
struct sk_buff *skb)
|
struct sk_buff *skb)
|
||||||
{
|
{
|
||||||
void (*edemux)(struct sk_buff *skb);
|
if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
|
||||||
|
!skb_dst(skb) && !skb->sk) {
|
||||||
if (net->ipv4.sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
|
switch (ipv6_hdr(skb)->nexthdr) {
|
||||||
const struct inet6_protocol *ipprot;
|
case IPPROTO_TCP:
|
||||||
|
if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux))
|
||||||
ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
|
tcp_v6_early_demux(skb);
|
||||||
if (ipprot && (edemux = READ_ONCE(ipprot->early_demux)))
|
break;
|
||||||
edemux(skb);
|
case IPPROTO_UDP:
|
||||||
|
if (READ_ONCE(net->ipv4.sysctl_udp_early_demux))
|
||||||
|
udp_v6_early_demux(skb);
|
||||||
|
break;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!skb_valid_dst(skb))
|
if (!skb_valid_dst(skb))
|
||||||
ip6_route_input(skb);
|
ip6_route_input(skb);
|
||||||
}
|
}
|
||||||
|
@ -1673,7 +1673,7 @@ do_time_wait:
|
|||||||
goto discard_it;
|
goto discard_it;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void tcp_v6_early_demux(struct sk_buff *skb)
|
void tcp_v6_early_demux(struct sk_buff *skb)
|
||||||
{
|
{
|
||||||
const struct ipv6hdr *hdr;
|
const struct ipv6hdr *hdr;
|
||||||
const struct tcphdr *th;
|
const struct tcphdr *th;
|
||||||
@ -2028,12 +2028,7 @@ struct proto tcpv6_prot = {
|
|||||||
.diag_destroy = tcp_abort,
|
.diag_destroy = tcp_abort,
|
||||||
};
|
};
|
||||||
|
|
||||||
/* thinking of making this const? Don't.
|
static const struct inet6_protocol tcpv6_protocol = {
|
||||||
* early_demux can change based on sysctl.
|
|
||||||
*/
|
|
||||||
static struct inet6_protocol tcpv6_protocol = {
|
|
||||||
.early_demux = tcp_v6_early_demux,
|
|
||||||
.early_demux_handler = tcp_v6_early_demux,
|
|
||||||
.handler = tcp_v6_rcv,
|
.handler = tcp_v6_rcv,
|
||||||
.err_handler = tcp_v6_err,
|
.err_handler = tcp_v6_err,
|
||||||
.flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
|
.flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
|
||||||
|
@ -912,7 +912,7 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net,
|
|||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void udp_v6_early_demux(struct sk_buff *skb)
|
void udp_v6_early_demux(struct sk_buff *skb)
|
||||||
{
|
{
|
||||||
struct net *net = dev_net(skb->dev);
|
struct net *net = dev_net(skb->dev);
|
||||||
const struct udphdr *uh;
|
const struct udphdr *uh;
|
||||||
@ -1533,12 +1533,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
/* thinking of making this const? Don't.
|
static const struct inet6_protocol udpv6_protocol = {
|
||||||
* early_demux can change based on sysctl.
|
|
||||||
*/
|
|
||||||
static struct inet6_protocol udpv6_protocol = {
|
|
||||||
.early_demux = udp_v6_early_demux,
|
|
||||||
.early_demux_handler = udp_v6_early_demux,
|
|
||||||
.handler = udpv6_rcv,
|
.handler = udpv6_rcv,
|
||||||
.err_handler = udpv6_err,
|
.err_handler = udpv6_err,
|
||||||
.flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
|
.flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
|
||||||
|
Loading…
Reference in New Issue
Block a user