d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

lltable: do not require prefix lookup when checking lle allocation rules.

Browse Source 
With the new FIB_ALGO infrastructure, nearly all subsystems use
 fib[46]_lookup() functions, which provides lockless lookups.
A number of places remains that uses old-style lookup functions, that
 still requires RIB read lock to return the result. One of such places
 is arp processing code.
FIB_ALGO implementation makes some tradeoffs, resulting in (relatively)
 prolonged periods of holding RIB_WLOCK. If the lock is held and datapath
 competes for it, the RX ring may get blocked, ending in traffic delays and losses.
As currently arp processing is performed directly in the interrupt handler,
 handling ARP replies triggers the problem descibed above when the amount of
 ARP replies is high.

To be more specific, prior to creating new ARP entry, routing lookup for the entry
 address in interface fib is executed. The following conditions are the verified:

1. If lookup returns an empty result, or the resulting prefix is non-directly-reachable,
 failure is returned. The only exception are host routes w/ gateway==address.
2. If the routing lookup returns different interface and non-host route,
 we want to support the use case of having multiple interfaces with the same prefix.
 In fact, the current code just checks if the returned prefix covers target address
 (always true) and effectively allow allocating ARP entries for any directly-reachable prefix,
 regardless of its interface.

Change the code to perform the following:

1) use fib4_lookup() to get the nexthop, instead of requesting exact prefix.
2) Rewrite first condition check using nexthop flags (1:1 match)
3) Rewrite second condition to check for interface addresses matching target address on
 the input interface.

Differential Revision: https://reviews.freebsd.org/D31824
Reviewed by:	ae
MFC after:	1 week
PR:	257965
This commit is contained in:
Alexander V. Chernikov 2021-09-03 11:48:36 +00:00
parent efe67f33c3
commit 936f4a42fa
1 changed files with 23 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
sys/netinet/in.c
View File

@ -64,6 +64,7 @@ __FBSDID("$FreeBSD$");
#include <netinet/if_ether.h>
#include <netinet/in.h>
#include <netinet/in_fib.h>
#include <netinet/in_var.h>
#include <netinet/in_pcb.h>
#include <netinet/ip_var.h>
@ -1358,48 +1359,32 @@ in_lltable_free_entry(struct lltable *llt, struct llentry *lle)
static int
in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr)
{
struct rt_addrinfo info;
struct sockaddr_in rt_key, rt_mask;
struct sockaddr rt_gateway;
int rt_flags;
struct nhop_object *nh;
struct in_addr addr;
KASSERT(l3addr->sa_family == AF_INET,
("sin_family %d", l3addr->sa_family));
bzero(&rt_key, sizeof(rt_key));
rt_key.sin_len = sizeof(rt_key);
bzero(&rt_mask, sizeof(rt_mask));
rt_mask.sin_len = sizeof(rt_mask);
bzero(&rt_gateway, sizeof(rt_gateway));
rt_gateway.sa_len = sizeof(rt_gateway);
addr = ((const struct sockaddr_in *)l3addr)->sin_addr;
bzero(&info, sizeof(info));
info.rti_info[RTAX_DST] = (struct sockaddr *)&rt_key;
info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&rt_mask;
info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&rt_gateway;
if (rib_lookup_info(ifp->if_fib, l3addr, NHR_REF, 0, &info) != 0)
nh = fib4_lookup(ifp->if_fib, addr, 0, NHR_NONE, 0);
if (nh == NULL)
return (EINVAL);
rt_flags = info.rti_flags;
/*
* If the gateway for an existing host route matches the target L3
* address, which is a special route inserted by some implementation
* such as MANET, and the interface is of the correct type, then
* allow for ARP to proceed.
*/
if (rt_flags & RTF_GATEWAY) {
if (!(rt_flags & RTF_HOST) || !info.rti_ifp ||
info.rti_ifp->if_type != IFT_ETHER ||
(info.rti_ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) != 0 ||
memcmp(rt_gateway.sa_data, l3addr->sa_data,
if (nh->nh_flags & NHF_GATEWAY) {
if (!(nh->nh_flags & NHF_HOST) || nh->nh_ifp->if_type != IFT_ETHER ||
(nh->nh_ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) != 0 ||
memcmp(nh->gw_sa.sa_data, l3addr->sa_data,
sizeof(in_addr_t)) != 0) {
rib_free_info(&info);
return (EINVAL);
}
}
rib_free_info(&info);
/*
* Make sure that at least the destination address is covered
@ -1408,35 +1393,23 @@ in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr
* on one interface and the corresponding outgoing packet leaves
* another interface.
*/
if (!(rt_flags & RTF_HOST) && info.rti_ifp != ifp) {
const char *sa, *mask, *addr, *lim;
const struct sockaddr_in *l3sin;
if ((nh->nh_ifp != ifp) && (nh->nh_flags & NHF_HOST) == 0) {
struct in_ifaddr *ia = (struct in_ifaddr *)ifaof_ifpforaddr(l3addr, ifp);
struct in_addr dst_addr, mask_addr;
mask = (const char *)&rt_mask;
/*
* Just being extra cautious to avoid some custom
* code getting into trouble.
*/
if ((info.rti_addrs & RTA_NETMASK) == 0)
if (ia == NULL)
return (EINVAL);
sa = (const char *)&rt_key;
addr = (const char *)l3addr;
l3sin = (const struct sockaddr_in *)l3addr;
lim = addr + l3sin->sin_len;
/*
* ifaof_ifpforaddr() returns _best matching_ IFA.
* It is possible that ifa prefix does not cover our address.
* Explicitly verify and fail if that's the case.
*/
dst_addr = IA_SIN(ia)->sin_addr;
mask_addr.s_addr = htonl(ia->ia_subnetmask);
for ( ; addr < lim; sa++, mask++, addr++) {
if ((*sa ^ *addr) & *mask) {
#ifdef DIAGNOSTIC
char addrbuf[INET_ADDRSTRLEN];
log(LOG_INFO, "IPv4 address: \"%s\" "
"is not on the network\n",
inet_ntoa_r(l3sin->sin_addr, addrbuf));
#endif
return (EINVAL);
}
}
if (!IN_ARE_MASKED_ADDR_EQUAL(dst_addr, addr, mask_addr))
return (EINVAL);
}
return (0);