Commit 7a9bc9b8 authored by David S. Miller's avatar David S. Miller

ipv4: Elide fib_validate_source() completely when possible.

If rpfilter is off (or the SKB has an IPSEC path) and there are not
tclassid users, we don't have to do anything at all when
fib_validate_source() is invoked besides setting the itag to zero.

We monitor tclassid uses with a counter (modified only under RTNL and
marked __read_mostly) and we protect the fib_validate_source() real
work with a test against this counter and whether rpfilter is to be
done.

Having a way to know whether we need no tclassid processing or not
also opens the door for future optimized rpfilter algorithms that do
not perform full FIB lookups.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b8c84307
...@@ -52,6 +52,7 @@ struct fib_rules_ops { ...@@ -52,6 +52,7 @@ struct fib_rules_ops {
struct sk_buff *, struct sk_buff *,
struct fib_rule_hdr *, struct fib_rule_hdr *,
struct nlattr **); struct nlattr **);
void (*delete)(struct fib_rule *);
int (*compare)(struct fib_rule *, int (*compare)(struct fib_rule *,
struct fib_rule_hdr *, struct fib_rule_hdr *,
struct nlattr **); struct nlattr **);
......
...@@ -235,6 +235,11 @@ extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, ...@@ -235,6 +235,11 @@ extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
u8 tos, int oif, struct net_device *dev, u8 tos, int oif, struct net_device *dev,
struct in_device *idev, u32 *itag); struct in_device *idev, u32 *itag);
extern void fib_select_default(struct fib_result *res); extern void fib_select_default(struct fib_result *res);
#ifdef CONFIG_IP_ROUTE_CLASSID
extern int fib_num_tclassid_users;
#else
#define fib_num_tclassid_users 0
#endif
/* Exported by fib_semantics.c */ /* Exported by fib_semantics.c */
extern int ip_fib_check_default(__be32 gw, struct net_device *dev); extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
......
...@@ -151,6 +151,8 @@ static void fib_rules_cleanup_ops(struct fib_rules_ops *ops) ...@@ -151,6 +151,8 @@ static void fib_rules_cleanup_ops(struct fib_rules_ops *ops)
list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) { list_for_each_entry_safe(rule, tmp, &ops->rules_list, list) {
list_del_rcu(&rule->list); list_del_rcu(&rule->list);
if (ops->delete)
ops->delete(rule);
fib_rule_put(rule); fib_rule_put(rule);
} }
} }
...@@ -499,6 +501,8 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) ...@@ -499,6 +501,8 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
notify_rule_change(RTM_DELRULE, rule, ops, nlh, notify_rule_change(RTM_DELRULE, rule, ops, nlh,
NETLINK_CB(skb).pid); NETLINK_CB(skb).pid);
if (ops->delete)
ops->delete(rule);
fib_rule_put(rule); fib_rule_put(rule);
flush_route_cache(ops); flush_route_cache(ops);
rules_ops_put(ops); rules_ops_put(ops);
......
...@@ -31,6 +31,7 @@ ...@@ -31,6 +31,7 @@
#include <linux/if_addr.h> #include <linux/if_addr.h>
#include <linux/if_arp.h> #include <linux/if_arp.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <linux/cache.h>
#include <linux/init.h> #include <linux/init.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/slab.h> #include <linux/slab.h>
...@@ -217,6 +218,10 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) ...@@ -217,6 +218,10 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
return inet_select_addr(dev, ip_hdr(skb)->saddr, scope); return inet_select_addr(dev, ip_hdr(skb)->saddr, scope);
} }
#ifdef CONFIG_IP_ROUTE_CLASSID
int fib_num_tclassid_users __read_mostly;
#endif
/* Given (packet source, input interface) and optional (dst, oif, tos): /* Given (packet source, input interface) and optional (dst, oif, tos):
* - (main) check, that source is valid i.e. not broadcast or our local * - (main) check, that source is valid i.e. not broadcast or our local
* address. * address.
...@@ -225,11 +230,11 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) ...@@ -225,11 +230,11 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
* - check, that packet arrived from expected physical interface. * - check, that packet arrived from expected physical interface.
* called with rcu_read_lock() * called with rcu_read_lock()
*/ */
int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos, static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
int oif, struct net_device *dev, struct in_device *idev, u8 tos, int oif, struct net_device *dev,
u32 *itag) int rpf, struct in_device *idev, u32 *itag)
{ {
int ret, no_addr, rpf, accept_local; int ret, no_addr, accept_local;
struct fib_result res; struct fib_result res;
struct flowi4 fl4; struct flowi4 fl4;
struct net *net; struct net *net;
...@@ -242,12 +247,9 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos, ...@@ -242,12 +247,9 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
fl4.flowi4_tos = tos; fl4.flowi4_tos = tos;
fl4.flowi4_scope = RT_SCOPE_UNIVERSE; fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
no_addr = rpf = accept_local = 0; no_addr = accept_local = 0;
no_addr = idev->ifa_list == NULL; no_addr = idev->ifa_list == NULL;
/* Ignore rp_filter for packets protected by IPsec. */
rpf = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
accept_local = IN_DEV_ACCEPT_LOCAL(idev); accept_local = IN_DEV_ACCEPT_LOCAL(idev);
fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0; fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
...@@ -303,6 +305,20 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos, ...@@ -303,6 +305,20 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
return -EXDEV; return -EXDEV;
} }
/* Ignore rp_filter for packets protected by IPsec. */
int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
u8 tos, int oif, struct net_device *dev,
struct in_device *idev, u32 *itag)
{
int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
if (!r && !fib_num_tclassid_users) {
*itag = 0;
return 0;
}
return __fib_validate_source(skb, src, dst, tos, oif, dev, r, idev, itag);
}
static inline __be32 sk_extract_addr(struct sockaddr *addr) static inline __be32 sk_extract_addr(struct sockaddr *addr)
{ {
return ((struct sockaddr_in *) addr)->sin_addr.s_addr; return ((struct sockaddr_in *) addr)->sin_addr.s_addr;
......
...@@ -169,8 +169,11 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, ...@@ -169,8 +169,11 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
rule4->dst = nla_get_be32(tb[FRA_DST]); rule4->dst = nla_get_be32(tb[FRA_DST]);
#ifdef CONFIG_IP_ROUTE_CLASSID #ifdef CONFIG_IP_ROUTE_CLASSID
if (tb[FRA_FLOW]) if (tb[FRA_FLOW]) {
rule4->tclassid = nla_get_u32(tb[FRA_FLOW]); rule4->tclassid = nla_get_u32(tb[FRA_FLOW]);
if (rule4->tclassid)
fib_num_tclassid_users++;
}
#endif #endif
rule4->src_len = frh->src_len; rule4->src_len = frh->src_len;
...@@ -184,6 +187,16 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb, ...@@ -184,6 +187,16 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
return err; return err;
} }
static void fib4_rule_delete(struct fib_rule *rule)
{
#ifdef CONFIG_IP_ROUTE_CLASSID
struct fib4_rule *rule4 = (struct fib4_rule *) rule;
if (rule4->tclassid)
fib_num_tclassid_users--;
#endif
}
static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
struct nlattr **tb) struct nlattr **tb)
{ {
...@@ -256,6 +269,7 @@ static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = { ...@@ -256,6 +269,7 @@ static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
.action = fib4_rule_action, .action = fib4_rule_action,
.match = fib4_rule_match, .match = fib4_rule_match,
.configure = fib4_rule_configure, .configure = fib4_rule_configure,
.delete = fib4_rule_delete,
.compare = fib4_rule_compare, .compare = fib4_rule_compare,
.fill = fib4_rule_fill, .fill = fib4_rule_fill,
.default_pref = fib_default_rule_pref, .default_pref = fib_default_rule_pref,
......
...@@ -163,6 +163,12 @@ void free_fib_info(struct fib_info *fi) ...@@ -163,6 +163,12 @@ void free_fib_info(struct fib_info *fi)
return; return;
} }
fib_info_cnt--; fib_info_cnt--;
#ifdef CONFIG_IP_ROUTE_CLASSID
change_nexthops(fi) {
if (nexthop_nh->nh_tclassid)
fib_num_tclassid_users--;
} endfor_nexthops(fi);
#endif
call_rcu(&fi->rcu, free_fib_info_rcu); call_rcu(&fi->rcu, free_fib_info_rcu);
} }
...@@ -421,6 +427,8 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, ...@@ -421,6 +427,8 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
#ifdef CONFIG_IP_ROUTE_CLASSID #ifdef CONFIG_IP_ROUTE_CLASSID
nla = nla_find(attrs, attrlen, RTA_FLOW); nla = nla_find(attrs, attrlen, RTA_FLOW);
nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0; nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
if (nexthop_nh->nh_tclassid)
fib_num_tclassid_users++;
#endif #endif
} }
...@@ -815,6 +823,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg) ...@@ -815,6 +823,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
nh->nh_flags = cfg->fc_flags; nh->nh_flags = cfg->fc_flags;
#ifdef CONFIG_IP_ROUTE_CLASSID #ifdef CONFIG_IP_ROUTE_CLASSID
nh->nh_tclassid = cfg->fc_flow; nh->nh_tclassid = cfg->fc_flow;
if (nh->nh_tclassid)
fib_num_tclassid_users++;
#endif #endif
#ifdef CONFIG_IP_ROUTE_MULTIPATH #ifdef CONFIG_IP_ROUTE_MULTIPATH
nh->nh_weight = 1; nh->nh_weight = 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment