880a6fab8f
Enable to specify local and remote prefix length thresholds for the
policy hash table via a netlink XFRM_MSG_NEWSPDINFO message.
prefix length thresholds are specified by XFRMA_SPD_IPV4_HTHRESH and
XFRMA_SPD_IPV6_HTHRESH optional attributes (struct xfrmu_spdhthresh).
example:
struct xfrmu_spdhthresh thresh4 = {
.lbits = 0;
.rbits = 24;
};
struct xfrmu_spdhthresh thresh6 = {
.lbits = 0;
.rbits = 56;
};
struct nlmsghdr *hdr;
struct nl_msg *msg;
msg = nlmsg_alloc();
hdr = nlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, XFRMA_SPD_IPV4_HTHRESH, sizeof(__u32), NLM_F_REQUEST);
nla_put(msg, XFRMA_SPD_IPV4_HTHRESH, sizeof(thresh4), &thresh4);
nla_put(msg, XFRMA_SPD_IPV6_HTHRESH, sizeof(thresh6), &thresh6);
nla_send_auto(sk, msg);
The numbers are the policy selector minimum prefix lengths to put a
policy in the hash table.
- lbits is the local threshold (source address for out policies,
destination address for in and fwd policies).
- rbits is the remote threshold (destination address for out
policies, source address for in and fwd policies).
The default values are:
XFRMA_SPD_IPV4_HTHRESH: 32 32
XFRMA_SPD_IPV6_HTHRESH: 128 128
Dynamic re-building of the SPD is performed when the thresholds values
are changed.
The current thresholds can be read via a XFRM_MSG_GETSPDINFO request:
the kernel replies to XFRM_MSG_GETSPDINFO requests by an
XFRM_MSG_NEWSPDINFO message, with both attributes
XFRMA_SPD_IPV4_HTHRESH and XFRMA_SPD_IPV6_HTHRESH.
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
89 lines
2.1 KiB
C
89 lines
2.1 KiB
C
#ifndef __NETNS_XFRM_H
|
|
#define __NETNS_XFRM_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/wait.h>
|
|
#include <linux/workqueue.h>
|
|
#include <linux/xfrm.h>
|
|
#include <net/dst_ops.h>
|
|
#include <net/flowcache.h>
|
|
|
|
struct ctl_table_header;
|
|
|
|
struct xfrm_policy_hash {
|
|
struct hlist_head *table;
|
|
unsigned int hmask;
|
|
u8 dbits4;
|
|
u8 sbits4;
|
|
u8 dbits6;
|
|
u8 sbits6;
|
|
};
|
|
|
|
struct xfrm_policy_hthresh {
|
|
struct work_struct work;
|
|
seqlock_t lock;
|
|
u8 lbits4;
|
|
u8 rbits4;
|
|
u8 lbits6;
|
|
u8 rbits6;
|
|
};
|
|
|
|
struct netns_xfrm {
|
|
struct list_head state_all;
|
|
/*
|
|
* Hash table to find appropriate SA towards given target (endpoint of
|
|
* tunnel or destination of transport mode) allowed by selector.
|
|
*
|
|
* Main use is finding SA after policy selected tunnel or transport
|
|
* mode. Also, it can be used by ah/esp icmp error handler to find
|
|
* offending SA.
|
|
*/
|
|
struct hlist_head *state_bydst;
|
|
struct hlist_head *state_bysrc;
|
|
struct hlist_head *state_byspi;
|
|
unsigned int state_hmask;
|
|
unsigned int state_num;
|
|
struct work_struct state_hash_work;
|
|
struct hlist_head state_gc_list;
|
|
struct work_struct state_gc_work;
|
|
|
|
struct list_head policy_all;
|
|
struct hlist_head *policy_byidx;
|
|
unsigned int policy_idx_hmask;
|
|
struct hlist_head policy_inexact[XFRM_POLICY_MAX * 2];
|
|
struct xfrm_policy_hash policy_bydst[XFRM_POLICY_MAX * 2];
|
|
unsigned int policy_count[XFRM_POLICY_MAX * 2];
|
|
struct work_struct policy_hash_work;
|
|
struct xfrm_policy_hthresh policy_hthresh;
|
|
|
|
|
|
struct sock *nlsk;
|
|
struct sock *nlsk_stash;
|
|
|
|
u32 sysctl_aevent_etime;
|
|
u32 sysctl_aevent_rseqth;
|
|
int sysctl_larval_drop;
|
|
u32 sysctl_acq_expires;
|
|
#ifdef CONFIG_SYSCTL
|
|
struct ctl_table_header *sysctl_hdr;
|
|
#endif
|
|
|
|
struct dst_ops xfrm4_dst_ops;
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
struct dst_ops xfrm6_dst_ops;
|
|
#endif
|
|
spinlock_t xfrm_state_lock;
|
|
rwlock_t xfrm_policy_lock;
|
|
struct mutex xfrm_cfg_mutex;
|
|
|
|
/* flow cache part */
|
|
struct flow_cache flow_cache_global;
|
|
atomic_t flow_cache_genid;
|
|
struct list_head flow_cache_gc_list;
|
|
spinlock_t flow_cache_gc_lock;
|
|
struct work_struct flow_cache_gc_work;
|
|
struct work_struct flow_cache_flush_work;
|
|
struct mutex flow_flush_sem;
|
|
};
|
|
|
|
#endif
|