From patchwork Tue Sep 7 19:35:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 12479267 X-Patchwork-Delegate: dsahern@gmail.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61F7FC433F5 for ; Tue, 7 Sep 2021 19:42:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 35DD76108D for ; Tue, 7 Sep 2021 19:42:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343833AbhIGTng (ORCPT ); Tue, 7 Sep 2021 15:43:36 -0400 Received: from host.78.145.23.62.rev.coltfrance.com ([62.23.145.78]:47058 "EHLO proxy.6wind.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S243501AbhIGTnb (ORCPT ); Tue, 7 Sep 2021 15:43:31 -0400 Received: from bretzel (unknown [10.16.0.57]) by proxy.6wind.com (Postfix) with ESMTPS id 564B1B29AA1; Tue, 7 Sep 2021 21:35:21 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.92) (envelope-from ) id 1mNgsL-0004IK-AL; Tue, 07 Sep 2021 21:35:21 +0200 From: Nicolas Dichtel To: steffen.klassert@secunet.com, davem@davemloft.net, kuba@kernel.org, antony.antony@secunet.com Cc: netdev@vger.kernel.org, Nicolas Dichtel Subject: [RFC PATCH iproute2] xfrm: enable to manage default policies Date: Tue, 7 Sep 2021 21:35:10 +0200 Message-Id: <20210907193510.16487-4-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210907193510.16487-1-nicolas.dichtel@6wind.com> References: <9b0ddb88-c7d3-9bb6-48f2-1967425b3fc7@6wind.com> <20210907193510.16487-1-nicolas.dichtel@6wind.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: dsahern@gmail.com X-Patchwork-State: RFC Two new commands to manage default policies: - ip xfrm policy setdefault - ip xfrm policy getdefault And the corresponding part in 'ip xfrm monitor'. Signed-off-by: Nicolas Dichtel --- include/uapi/linux/xfrm.h | 9 ++- ip/xfrm.h | 1 + ip/xfrm_monitor.c | 3 + ip/xfrm_policy.c | 121 ++++++++++++++++++++++++++++++++++++++ man/man8/ip-xfrm.8 | 12 ++++ 5 files changed, 143 insertions(+), 3 deletions(-) diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h index ecd06396eb16..2a8135e31f9d 100644 --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h @@ -514,9 +514,12 @@ struct xfrm_user_offload { #define XFRM_OFFLOAD_INBOUND 2 struct xfrm_userpolicy_default { -#define XFRM_USERPOLICY_DIRMASK_MAX (sizeof(__u8) * 8) - __u8 dirmask; - __u8 action; +#define XFRM_USERPOLICY_UNSPEC 0 +#define XFRM_USERPOLICY_BLOCK 1 +#define XFRM_USERPOLICY_ACCEPT 2 + __u8 in; + __u8 fwd; + __u8 out; }; /* backwards compatibility for userspace */ diff --git a/ip/xfrm.h b/ip/xfrm.h index 9ba5ca61d5e4..17dcf3fea83f 100644 --- a/ip/xfrm.h +++ b/ip/xfrm.h @@ -132,6 +132,7 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo, void xfrm_policy_info_print(struct xfrm_userpolicy_info *xpinfo, struct rtattr *tb[], FILE *fp, const char *prefix, const char *title); +int xfrm_policy_default_print(struct nlmsghdr *n, FILE *fp); int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family, int loose, int *argcp, char ***argvp); int xfrm_mode_parse(__u8 *mode, int *argcp, char ***argvp); diff --git a/ip/xfrm_monitor.c b/ip/xfrm_monitor.c index e34b5fbda130..f67424c5be06 100644 --- a/ip/xfrm_monitor.c +++ b/ip/xfrm_monitor.c @@ -323,6 +323,9 @@ static int xfrm_accept_msg(struct rtnl_ctrl_data *ctrl, case XFRM_MSG_MAPPING: xfrm_mapping_print(n, arg); return 0; + case XFRM_MSG_GETDEFAULT: + xfrm_policy_default_print(n, arg); + return 0; default: break; } diff --git a/ip/xfrm_policy.c b/ip/xfrm_policy.c index 7cc00e7c2f5b..744f331ff564 100644 --- a/ip/xfrm_policy.c +++ b/ip/xfrm_policy.c @@ -66,6 +66,8 @@ static void usage(void) "Usage: ip xfrm policy flush [ ptype PTYPE ]\n" "Usage: ip xfrm policy count\n" "Usage: ip xfrm policy set [ hthresh4 LBITS RBITS ] [ hthresh6 LBITS RBITS ]\n" + "Usage: ip xfrm policy setdefault DIR ACTION [ DIR ACTION ] [ DIR ACTION ]\n" + "Usage: ip xfrm policy getdefault\n" "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n" "UPSPEC := proto { { tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |\n" " { icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |\n" @@ -1124,6 +1126,121 @@ static int xfrm_spd_getinfo(int argc, char **argv) return 0; } +static int xfrm_spd_setdefault(int argc, char **argv) +{ + struct rtnl_handle rth; + struct { + struct nlmsghdr n; + struct xfrm_userpolicy_default up; + } req = { + .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_default)), + .n.nlmsg_flags = NLM_F_REQUEST, + .n.nlmsg_type = XFRM_MSG_SETDEFAULT, + }; + + while (argc > 0) { + if (strcmp(*argv, "in") == 0) { + if (req.up.in) + duparg("in", *argv); + + NEXT_ARG(); + if (strcmp(*argv, "block") == 0) + req.up.in = XFRM_USERPOLICY_BLOCK; + else if (strcmp(*argv, "accept") == 0) + req.up.in = XFRM_USERPOLICY_ACCEPT; + else + invarg("in policy value is invalid", *argv); + } else if (strcmp(*argv, "fwd") == 0) { + if (req.up.fwd) + duparg("fwd", *argv); + + NEXT_ARG(); + if (strcmp(*argv, "block") == 0) + req.up.fwd = XFRM_USERPOLICY_BLOCK; + else if (strcmp(*argv, "accept") == 0) + req.up.fwd = XFRM_USERPOLICY_ACCEPT; + else + invarg("fwd policy value is invalid", *argv); + } else if (strcmp(*argv, "out") == 0) { + if (req.up.out) + duparg("out", *argv); + + NEXT_ARG(); + if (strcmp(*argv, "block") == 0) + req.up.out = XFRM_USERPOLICY_BLOCK; + else if (strcmp(*argv, "accept") == 0) + req.up.out = XFRM_USERPOLICY_ACCEPT; + else + invarg("out policy value is invalid", *argv); + } else { + invarg("unknown direction", *argv); + } + + argc--; argv++; + } + + if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) + exit(1); + + if (rtnl_talk(&rth, &req.n, NULL) < 0) + exit(2); + + rtnl_close(&rth); + + return 0; +} + +int xfrm_policy_default_print(struct nlmsghdr *n, FILE *fp) +{ + struct xfrm_userpolicy_default *up = NLMSG_DATA(n); + int len = n->nlmsg_len - NLMSG_SPACE(sizeof(*up)); + + if (len < 0) { + fprintf(stderr, + "BUG: short nlmsg len %u (expect %lu) for XFRM_MSG_GETDEFAULT\n", + n->nlmsg_len, NLMSG_SPACE(sizeof(*up))); + return -1; + } + + fprintf(fp, "Default policies:\n"); + fprintf(fp, " in: %s\n", + up->in == XFRM_USERPOLICY_BLOCK ? "block" : "accept"); + fprintf(fp, " fwd: %s\n", + up->fwd == XFRM_USERPOLICY_BLOCK ? "block" : "accept"); + fprintf(fp, " out: %s\n", + up->out == XFRM_USERPOLICY_BLOCK ? "block" : "accept"); + fflush(fp); + + return 0; +} + +static int xfrm_spd_getdefault(int argc, char **argv) +{ + struct rtnl_handle rth; + struct { + struct nlmsghdr n; + struct xfrm_userpolicy_default up; + } req = { + .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_default)), + .n.nlmsg_flags = NLM_F_REQUEST, + .n.nlmsg_type = XFRM_MSG_GETDEFAULT, + }; + struct nlmsghdr *answer; + + if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) + exit(1); + + if (rtnl_talk(&rth, &req.n, &answer) < 0) + exit(2); + + xfrm_policy_default_print(answer, (FILE *)stdout); + + free(answer); + rtnl_close(&rth); + + return 0; +} + static int xfrm_policy_flush(int argc, char **argv) { struct rtnl_handle rth; @@ -1197,6 +1314,10 @@ int do_xfrm_policy(int argc, char **argv) return xfrm_spd_getinfo(argc, argv); if (matches(*argv, "set") == 0) return xfrm_spd_setinfo(argc-1, argv+1); + if (matches(*argv, "setdefault") == 0) + return xfrm_spd_setdefault(argc-1, argv+1); + if (matches(*argv, "getdefault") == 0) + return xfrm_spd_getdefault(argc-1, argv+1); if (matches(*argv, "help") == 0) usage(); fprintf(stderr, "Command \"%s\" is unknown, try \"ip xfrm policy help\".\n", *argv); diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8 index 003f6c3d1c28..bf725cabb82d 100644 --- a/man/man8/ip-xfrm.8 +++ b/man/man8/ip-xfrm.8 @@ -298,6 +298,18 @@ ip-xfrm \- transform configuration .RB "[ " hthresh6 .IR LBITS " " RBITS " ]" +.ti -8 +.B "ip xfrm policy setdefault" +.IR DIR +.IR ACTION " [ " +.IR DIR +.IR ACTION " ] [ " +.IR DIR +.IR ACTION " ]" + +.ti -8 +.B "ip xfrm policy getdefault" + .ti -8 .IR SELECTOR " :=" .RB "[ " src From patchwork Tue Sep 7 19:35:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Dichtel X-Patchwork-Id: 12479269 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22402C433EF for ; Tue, 7 Sep 2021 19:42:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 04C0A6108D for ; Tue, 7 Sep 2021 19:42:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345595AbhIGTng (ORCPT ); Tue, 7 Sep 2021 15:43:36 -0400 Received: from host.78.145.23.62.rev.coltfrance.com ([62.23.145.78]:47051 "EHLO proxy.6wind.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232112AbhIGTnb (ORCPT ); Tue, 7 Sep 2021 15:43:31 -0400 Received: from bretzel (unknown [10.16.0.57]) by proxy.6wind.com (Postfix) with ESMTPS id 55DC5B29AA0; Tue, 7 Sep 2021 21:35:21 +0200 (CEST) Received: from dichtel by bretzel with local (Exim 4.92) (envelope-from ) id 1mNgsL-0004IG-9r; Tue, 07 Sep 2021 21:35:21 +0200 From: Nicolas Dichtel To: steffen.klassert@secunet.com, davem@davemloft.net, kuba@kernel.org, antony.antony@secunet.com Cc: netdev@vger.kernel.org, Nicolas Dichtel Subject: [PATCH ipsec 2/2] xfrm: notify default policy on update Date: Tue, 7 Sep 2021 21:35:09 +0200 Message-Id: <20210907193510.16487-3-nicolas.dichtel@6wind.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210907193510.16487-1-nicolas.dichtel@6wind.com> References: <9b0ddb88-c7d3-9bb6-48f2-1967425b3fc7@6wind.com> <20210907193510.16487-1-nicolas.dichtel@6wind.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org This configuration knob is very sensible, it should be notified when changing. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Signed-off-by: Nicolas Dichtel Reported-by: kernel test robot --- net/xfrm/xfrm_user.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 4e1c4dd53fe2..af9803f18ff7 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1961,6 +1961,36 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb, return skb; } +static int xfrm_notify_userpolicy(const struct net *net) +{ + struct xfrm_userpolicy_default *up; + int len = NLMSG_ALIGN(sizeof(*up)); + struct nlmsghdr *nlh; + struct sk_buff *skb; + + skb = nlmsg_new(len, GFP_ATOMIC); + if (skb == NULL) + return -ENOMEM; + + nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_GETDEFAULT, sizeof(*up), 0); + if (nlh == NULL) { + kfree_skb(skb); + return -EMSGSIZE; + } + + up = nlmsg_data(nlh); + up->in = net->xfrm.policy_default & XFRM_POL_DEFAULT_IN ? + XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; + up->fwd = net->xfrm.policy_default & XFRM_POL_DEFAULT_FWD ? + XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; + up->out = net->xfrm.policy_default & XFRM_POL_DEFAULT_OUT ? + XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; + + nlmsg_end(skb, nlh); + + return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); +} + static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, struct nlattr **attrs) { @@ -1984,6 +2014,7 @@ static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, rt_genid_bump_all(net); + xfrm_notify_userpolicy(net); return 0; }