diff options
author | Antony Antony <antony.antony@secunet.com> | 2021-12-22 16:11:18 +0300 |
---|---|---|
committer | Steffen Klassert <steffen.klassert@secunet.com> | 2021-12-23 11:32:51 +0300 |
commit | 4e484b3e969b52effd95c17f7a86f39208b2ccf4 (patch) | |
tree | 813756c3b558d6f58ce1e828f59183ed6ab9417d /net/ipv6 | |
parent | 23b6a6df94c6ce434e7947cfad14b1640fb9f794 (diff) | |
download | linux-4e484b3e969b52effd95c17f7a86f39208b2ccf4.tar.xz |
xfrm: rate limit SA mapping change message to user space
Kernel generates mapping change message, XFRM_MSG_MAPPING,
when a source port chage is detected on a input state with UDP
encapsulation set. Kernel generates a message for each IPsec packet
with new source port. For a high speed flow per packet mapping change
message can be excessive, and can overload the user space listener.
Introduce rate limiting for XFRM_MSG_MAPPING message to the user space.
The rate limiting is configurable via netlink, when adding a new SA or
updating it. Use the new attribute XFRMA_MTIMER_THRESH in seconds.
v1->v2 change:
update xfrm_sa_len()
v2->v3 changes:
use u32 insted unsigned long to reduce size of struct xfrm_state
fix xfrm_ompat size Reported-by: kernel test robot <lkp@intel.com>
accept XFRM_MSG_MAPPING only when XFRMA_ENCAP is present
Co-developed-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions