]> www.infradead.org Git - users/jedix/linux-maple.git/commit
xfrm: support sending NAT keepalives in ESP in UDP states
authorEyal Birger <eyal.birger@gmail.com>
Tue, 28 May 2024 03:29:14 +0000 (20:29 -0700)
committerSteffen Klassert <steffen.klassert@secunet.com>
Wed, 26 Jun 2024 11:22:42 +0000 (13:22 +0200)
commitf531d13bdfe3f4f084aaa8acae2cb0f02295f5ae
tree4a90306144790ba365971577562c3f74a4eac04e
parent5233a55a5254ea38dcdd8d836a0f9ee886c3df51
xfrm: support sending NAT keepalives in ESP in UDP states

Add the ability to send out RFC-3948 NAT keepalives from the xfrm stack.

To use, Userspace sets an XFRM_NAT_KEEPALIVE_INTERVAL integer property when
creating XFRM outbound states which denotes the number of seconds between
keepalive messages.

Keepalive messages are sent from a per net delayed work which iterates over
the xfrm states. The logic is guarded by the xfrm state spinlock due to the
xfrm state walk iterator.

Possible future enhancements:

- Adding counters to keep track of sent keepalives.
- deduplicate NAT keepalives between states sharing the same nat keepalive
  parameters.
- provisioning hardware offloads for devices capable of implementing this.
- revise xfrm state list to use an rcu list in order to avoid running this
  under spinlock.

Suggested-by: Paul Wouters <paul.wouters@aiven.io>
Tested-by: Paul Wouters <paul.wouters@aiven.io>
Tested-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
12 files changed:
include/net/ipv6_stubs.h
include/net/netns/xfrm.h
include/net/xfrm.h
include/uapi/linux/xfrm.h
net/ipv6/af_inet6.c
net/ipv6/xfrm6_policy.c
net/xfrm/Makefile
net/xfrm/xfrm_compat.c
net/xfrm/xfrm_nat_keepalive.c [new file with mode: 0644]
net/xfrm/xfrm_policy.c
net/xfrm/xfrm_state.c
net/xfrm/xfrm_user.c