Changes in Makefile

98e20e5e - bpfilter: remove bpfilter

Tue, 26 Dec 2023 13:07:42 +0000

bpfilter: remove bpfilterbpfilter was supposed to convert iptables filtering rules intoBPF programs on the fly, from the kernel, through a usermodehelper. The base code for the UMH was introduced in 2018, andcouple of attempts (2, 3) tried to introduce the BPF programgenerate features but were abandoned.bpfilter now sits in a kernel tree unused and unusable, occasionallycausing confusion amongst Linux users (4, 5).As bpfilter is now developed in a dedicated repository on GitHub (6),it was suggested a couple of times this year (LSFMM/BPF 2023,LPC 2023) to remove the deprecated kernel part of the project. Thisis the purpose of this patch.[1]: https://lore.kernel.org/lkml/20180522022230.2492505-1-ast@kernel.org/[2]: https://lore.kernel.org/bpf/20210829183608.2297877-1-me@ubique.spb.ru/#t[3]: https://lore.kernel.org/lkml/20221224000402.476079-1-qde@naccy.de/[4]: https://dxuuu.xyz/bpfilter.html[5]: https://github.com/linuxkit/linuxkit/pull/3904[6]: https://github.com/facebook/bpfilterSigned-off-by: Quentin Deslandes Link: https://lore.kernel.org/r/20231226130745.465988-1-qde@naccy.deSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/ipv4/Makefile

4954f17d - net/tcp: Introduce TCP_AO setsockopt()s

Mon, 23 Oct 2023 19:21:55 +0000

net/tcp: Introduce TCP_AO setsockopt()sAdd 3 setsockopt()s:1. TCP_AO_ADD_KEY to add a new Master Key Tuple (MKT) on a socket2. TCP_AO_DEL_KEY to delete present MKT from a socket3. TCP_AO_INFO to change flags, Current_key/RNext_key on a TCP-AO skUserspace has to introduce keys on every socket it wants to use TCP-AOoption on, similarly to TCP_MD5SIG/TCP_MD5SIG_EXT.RFC5925 prohibits definition of MKTs that would match the same peer,so do sanity checks on the data provided by userspace. Be asconservative as possible, including refusal of defining MKT onan established connection with no AO, removing the key in-use and etc.(1) and (2) are to be used by userspace key manager to add/remove keys.(3) main purpose is to set RNext_key, which (as prescribed by RFC5925)is the KeyID that will be requested in TCP-AO header from the peer tosign their segments with.At this moment the life of ao_info ends in tcp_v4_destroy_sock().Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

8c73b263 - net/tcp: Prepare tcp_md5sig_pool for TCP-AO

Mon, 23 Oct 2023 19:21:53 +0000

net/tcp: Prepare tcp_md5sig_pool for TCP-AOTCP-AO, similarly to TCP-MD5, needs to allocate tfms on a slow-path,which is setsockopt() and use crypto ahash requests on fast paths,which are RX/TX softirqs. Also, it needs a temporary/scratch bufferfor preparing the hash.Rework tcp_md5sig_pool in order to support other hashing algorithmsthan MD5. It will make it possible to share pre-allocated crypto_ahashdescriptors and scratch area between all TCP hash users.Internally tcp_sigpool calls crypto_clone_ahash() API over pre-allocatedcrypto ahash tfm. Kudos to Herbert, who provided this new crypto API.I was a little concerned over GFP_ATOMIC allocations of ahash andcrypto_request in RX/TX (see tcp_sigpool_start()), so I benchmarked both"backends" with different algorithms, using patched version of iperf3[2].On my laptop with i7-7600U @ 2.80GHz: clone-tfm per-CPU-requestsTCP-MD5 2.25 Gbits/sec 2.30 Gbits/secTCP-AO(hmac(sha1)) 2.53 Gbits/sec 2.54 Gbits/secTCP-AO(hmac(sha512)) 1.67 Gbits/sec 1.64 Gbits/secTCP-AO(hmac(sha384)) 1.77 Gbits/sec 1.80 Gbits/secTCP-AO(hmac(sha224)) 1.29 Gbits/sec 1.30 Gbits/secTCP-AO(hmac(sha3-512)) 481 Mbits/sec 480 Mbits/secTCP-AO(hmac(md5)) 2.07 Gbits/sec 2.12 Gbits/secTCP-AO(hmac(rmd160)) 1.01 Gbits/sec 995 Mbits/secTCP-AO(cmac(aes128)) [not supporetd yet] 2.11 Gbits/secSo, it seems that my concerns don't have strong grounds and per-CPUcrypto_request allocation can be dropped/removed from tcp_sigpool onceciphers get crypto_clone_ahash() support.[1]: https://lore.kernel.org/all/ZDefxOq6Ax0JeTRH@gondor.apana.org.au/T/#u[2]: https://github.com/0x7f454c46/iperf/tree/tcp-md5-aoSigned-off-by: Dmitry Safonov Reviewed-by: Steen Hegelund Acked-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

c50e9609 - bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs

Fri, 07 Apr 2023 13:38:54 +0000

bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncsAdd two new kfuncs that allow a BPF tc-hook, installed on an ipipdevice in collect-metadata mode, to control FOU encap parameters on aper-packet level. The set of kfuncs is registered with the fou module.The bpf_skb_set_fou_encap kfunc is supposed to be used in tandem and aftera successful call to the bpf_skb_set_tunnel_key bpf-helper. UDP source anddestination ports can be controlled by passing a struct bpf_fou_encap. Asource port of zero will auto-assign a source port. enum bpf_fou_encap_typeis used to specify if the egress path should FOU or GUE encap the packet.On the ingress path bpf_skb_get_fou_encap can be used to read UDP sourceand destination ports from the receiver's point of view and allows forpacket multiplexing across different destination ports within a singleBPF program and ipip device.Signed-off-by: Christian Ehrig Link: https://lore.kernel.org/r/e17c94a646b63e78ce0dbf3f04b2c33dc948a32d.1680874078.git.cehrig@cloudflare.comSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/ipv4/Makefile

1d562c32 - net: fou: use policy and operation tables generated from the spec

Fri, 20 Jan 2023 17:50:40 +0000

net: fou: use policy and operation tables generated from the specGenerate and plug in the spec-based tables.A little bit of renaming is needed in the FOU code.Acked-by: Stanislav Fomichev Signed-off-by: Jakub Kicinski Signed-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv4/Makefile

08d32323 - net: fou: rename the source for linking

Fri, 20 Jan 2023 17:50:39 +0000

net: fou: rename the source for linkingWe'll need to link two objects together to form the fou module.This means the source can't be called fou, the build system expectsfou.o to be the combined object.Acked-by: Stanislav Fomichev Signed-off-by: Jakub Kicinski Signed-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv4/Makefile

1a91bb7c - tcp: add PLB functionality for TCP

Wed, 26 Oct 2022 13:51:12 +0000

tcp: add PLB functionality for TCPCongestion control algorithms track PLB state and cause the connectionto trigger a path change when either of the 2 conditions is satisfied:- No packets are in flight and (# consecutive congested rounds >= sysctl_tcp_plb_idle_rehash_rounds)- (# consecutive congested rounds >= sysctl_tcp_plb_rehash_rounds)A round (RTT) is marked as congested when congestion signal(ECN ce_ratio) over an RTT is greater than sysctl_tcp_plb_cong_thresh.In the event of RTO, PLB (via tcp_write_timeout()) triggers a pathchange and disables congestion-triggered path changes for random timebetween (sysctl_tcp_plb_suspend_rto_sec, 2*sysctl_tcp_plb_suspend_rto_sec)to avoid hopping onto the "connectivity blackhole". RTO-triggeredpath changes can still happen during this cool-off period.Signed-off-by: Mubashir Adnan Qureshi Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

88759609 - bpf: Clean up sockmap related Kconfigs

Tue, 23 Feb 2021 18:49:26 +0000

bpf: Clean up sockmap related KconfigsAs suggested by John, clean up sockmap related Kconfigs:Reduce the scope of CONFIG_BPF_STREAM_PARSER down to TCP streamparser, to reflect its name.Make the rest sockmap code simply depend on CONFIG_BPF_SYSCALLand CONFIG_INET, the latter is still needed at this point becauseof TCP/UDP proto update. And leave CONFIG_NET_SOCK_MSG untouched,as it is used by non-sockmap cases.Signed-off-by: Cong Wang Signed-off-by: Alexei Starovoitov Reviewed-by: Lorenz Bauer Acked-by: John Fastabend Acked-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20210223184934.6054-2-xiyou.wangcong@gmail.com List of files: /linux-6.15/net/ipv4/Makefile

cc4e3835 - udp_tunnel: add central NIC RX port offload infrastructure

Fri, 10 Jul 2020 00:42:46 +0000

udp_tunnel: add central NIC RX port offload infrastructureCater to devices which: (a) may want to sleep in the callbacks; (b) only have IPv4 support; (c) need all the programming to happen while the netdev is up.Drivers attach UDP tunnel offload info struct to their netdevs,where they declare how many UDP ports of various tunnel typesthey support. Core takes care of tracking which ports to offload.Use a fixed-size array since this matches what almost all driversdo, and avoids a complexity and uncertainty around memory allocationsin an atomic context.Make sure that tunnel drivers don't try to replay the ports whennew NIC netdev is registered. Automatic replays would mess upreference counting, and will be removed completely once all driversare converted.v4: - use a #define NULL to avoid build issues with CONFIG_INET=n.Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

edc6741c - bpf: Add sockmap hooks for UDP sockets

Mon, 09 Mar 2020 11:12:38 +0000

bpf: Add sockmap hooks for UDP socketsAdd basic psock hooks for UDP sockets. This allows adding andremoving sockets, as well as automatic removal on unhash and close.Signed-off-by: Lorenz Bauer Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20200309111243.6982-8-lmb@cloudflare.com List of files: /linux-6.15/net/ipv4/Makefile

0baf26b0 - bpf: tcp: Support tcp_congestion_ops in bpf

Thu, 09 Jan 2020 00:35:08 +0000

bpf: tcp: Support tcp_congestion_ops in bpfThis patch makes "struct tcp_congestion_ops" to be the first userof BPF STRUCT_OPS. It allows implementing a tcp_congestion_opsin bpf.The BPF implemented tcp_congestion_ops can be used likeregular kernel tcp-cc through sysctl and setsockopt. e.g.[root@arch-fb-vm1 bpf]# sysctl -a | egrep congestionnet.ipv4.tcp_allowed_congestion_control = reno cubic bpf_cubicnet.ipv4.tcp_available_congestion_control = reno bic cubic bpf_cubicnet.ipv4.tcp_congestion_control = bpf_cubicThere has been attempt to move the TCP CC to the user space(e.g. CCP in TCP). The common arguments are faster turn around,get away from long-tail kernel versions in production...etc,which are legit points.BPF has been the continuous effort to join both kernel anduserspace upsides together (e.g. XDP to gain the performanceadvantage without bypassing the kernel). The recent BPFadvancements (in particular BTF-aware verifier, BPF trampoline,BPF CO-RE...) made implementing kernel struct ops (e.g. tcp cc)possible in BPF. It allows a faster turnaround for testing algorithmin the production while leveraging the existing (and continue growing)BPF feature/framework instead of building one specifically foruserspace TCP CC.This patch allows write access to a few fields in tcp-sock(in bpf_tcp_ca_btf_struct_access()).The optional "get_info" is unsupported now. It can be addedlater. One possible way is to output the info with a btf-idto describe the content.Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20200109003508.3856115-1-kafai@fb.com List of files: /linux-6.15/net/ipv4/Makefile

ab84be7e - net: Initial nexthop code

Fri, 24 May 2019 21:43:04 +0000

net: Initial nexthop codeBarebones start point for nexthops. Implementation for RTM commands,notifications, management of rbtree for holding nexthops by id, andkernel side data structures for nexthops and nexthop config.Nexthops are maintained in an rbtree sorted by id. Similar to routes,nexthops are configured per namespace using netns_nexthop struct addedto struct net.Nexthop notifications are sent when a nexthop is added or deleted,but NOT if the delete is due to a device event or network namespaceteardown (which also involves device events). Applications areexpected to use the device down event to flush nexthops and anyroutes used by the nexthops.Signed-off-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

4c145dce - xfrm: make xfrm modes builtin

Fri, 29 Mar 2019 20:16:31 +0000

xfrm: make xfrm modes builtinafter previous changes, xfrm_mode contains no function pointers anymoreand all modules defining such struct contain no code except an init/exitfunctions to register the xfrm_mode struct with the xfrm core.Just place the xfrm modes core and remove the modules,the run-time xfrm_mode register/unregister functionality is removed.Before: text data bss dec filename 7523 200 2364 10087 net/xfrm/xfrm_input.o 40003 628 440 41071 net/xfrm/xfrm_state.o15730338 6937080 4046908 26714326 vmlinux 7389 200 2364 9953 net/xfrm/xfrm_input.o 40574 656 440 41670 net/xfrm/xfrm_state.o15730084 6937068 4046908 26714060 vmlinuxThe xfrm*_mode_{transport,tunnel,beet} modules are gone.v2: replace CONFIG_INET6_XFRM_MODE_* IS_ENABLED guards with CONFIG_IPV6 ones rather than removing them.Signed-off-by: Florian Westphal Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/ipv4/Makefile

604326b4 - bpf, sockmap: convert to generic sk_msg interface

Sat, 13 Oct 2018 00:45:58 +0000

bpf, sockmap: convert to generic sk_msg interfaceAdd a generic sk_msg layer, and convert current sockmap and laterkTLS over to make use of it. While sk_buff handles network packetrepresentation from netdevice up to socket, sk_msg handles datarepresentation from application to socket layer.This means that sk_msg framework spans across ULP users in thekernel, and enables features such as introspection or filteringof data with the help of BPF programs that operate on this datastructure.Latter becomes in particular useful for kTLS where data encryptionis deferred into the kernel, and as such enabling the kernel toperform L7 introspection and policy based on BPF for TLS connectionswhere the record is being encrypted after BPF has run and came toa verdict. In order to get there, first step is to transform opencoding of scatter-gather list handling into a common core frameworkthat subsystems can use.The code itself has been split and refactored into three biggerpieces: i) the generic sk_msg API which deals with managing thescatter gather ring, providing helpers for walking and mangling,transferring application data from user space into it, and preparingit for BPF pre/post-processing, ii) the plain sock map itselfwhere sockets can be attached to or detached from; these bitsare independent of i) which can now be used also without sockmap, and iii) the integration with plain TCP as one protocolto be used for processing L7 application data (later this coulde.g. also be extended to other protocols like UDP). The semanticsare the same with the old sock map code and therefore no changeof user facing behavior or APIs. While pursuing this work italso helped finding a number of bugs in the old sockmap codethat we've fixed already in earlier commits. The test_sockmapkselftest suite passes through fine as well.Joint work with John.Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov List of files: /linux-6.15/net/ipv4/Makefile

e446a276 - net: remove blank lines at end of file

Tue, 24 Jul 2018 19:29:18 +0000

net: remove blank lines at end of fileSeveral files have extra line at end of file.Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

404eb77e - ipv4: support sport, dport and ip_proto in RTM_GETROUTE

Tue, 22 May 2018 21:03:27 +0000

ipv4: support sport, dport and ip_proto in RTM_GETROUTEThis is a followup to fib rules sport, dport and ipprotomatch support. Only supports tcp, udp and icmp for ipproto.Used by fib rule self tests.Signed-off-by: Roopa Prabhu Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

d2ba09c1 - net: add skeleton of bpfilter kernel module

Tue, 22 May 2018 02:22:30 +0000

net: add skeleton of bpfilter kernel modulebpfilter.ko consists of bpfilter_kern.c (normal kernel module code)and user mode helper code that is embedded into bpfilter.koThe steps to build bpfilter.ko are the following:- main.c is compiled by HOSTCC into the bpfilter_umh elf executable file- with quite a bit of objcopy and Makefile magic the bpfilter_umh elf file is converted into bpfilter_umh.o object file with _binary_net_bpfilter_bpfilter_umh_start and _end symbols Example: $ nm ./bld_x64/net/bpfilter/bpfilter_umh.o 0000000000004cf8 T _binary_net_bpfilter_bpfilter_umh_end 0000000000004cf8 A _binary_net_bpfilter_bpfilter_umh_size 0000000000000000 T _binary_net_bpfilter_bpfilter_umh_start- bpfilter_umh.o and bpfilter_kern.o are linked together into bpfilter.kobpfilter_kern.c is a normal kernel module code that callsthe fork_usermode_blob() helper to execute part of its own dataas a user mode process.Notice that _binary_net_bpfilter_bpfilter_umh_start - endis placed into .init.rodata section, so it's freed as soon as __initfunction of bpfilter.ko is finished.As part of __init the bpfilter.ko does first request/reply actionvia two unix pipe provided by fork_usermode_blob() helper tomake sure that umh is healthy. If not it will kill it via pid.Later bpfilter_process_sockopt() will be called from bpfilter hooksin get/setsockopt() to pass iptable commands into umh via bpfilter.koIf admin does 'rmmod bpfilter' the __exit code bpfilter.ko willkill umh as well.Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

a919525a - net: Move fib_convert_metrics to metrics file

Wed, 18 Apr 2018 00:33:07 +0000

net: Move fib_convert_metrics to metrics fileMove logic of fib_convert_metrics into ip_metrics_convert. This allowsthe code that converts netlink attributes into metrics struct to bere-used in a later patch by IPv6.This is mostly a code move with the following changes to variable names: - fi->fib_net becomes net - fc_mx and fc_mx_len are passed as inputs pulled from fib_config - metrics array is passed as an input from fi->fib_metrics->metricsSigned-off-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

6853f21f - ipmr,ipmr6: Define a uniform vif_device

Wed, 28 Feb 2018 21:29:29 +0000

ipmr,ipmr6: Define a uniform vif_deviceThe two implementations have almost identical structures - vif_device andmif_device. As a step toward uniforming the mr_tables, eliminate themif_device and relocate the vif_device definition into a new commonheader file.Also, introduce a common initializing function for setting most of thevif_device fields in a new common source file. This requires modifyingthe ipv{4,6] Kconfig and ipv4 makefile as we're introducing a new commonconfig option - CONFIG_IP_MROUTE_COMMON.Signed-off-by: Yuval Mintz Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile

6987990c - net: tcp: Remove TCP probe module

Fri, 29 Dec 2017 02:46:21 +0000

net: tcp: Remove TCP probe moduleRemove TCP probe module since jprobe has been deprecated.That function is now replaced by tcp/tcp_probe trace-event.You can use it via ftrace or perftools.Signed-off-by: Masami Hiramatsu Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/Makefile