net: Add support for VRFs to inetpeer cache

inetpeer caches based on address only, so duplicate IP addresses within
a namespace return the same cached entry. Enhance the ipv4 address key
to contain both the IPv4 address and VRF device index.

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index e34f98aa93b19121b64411bead6d4fbccf0b9ffa..4a6009d4486b9cfc914d583c5065a3be3d23fa7e 100644 (file)
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -15,11 +15,17 @@
 #include <net/ipv6.h>
 #include <linux/atomic.h>
 
+/* IPv4 address key for cache lookups */
+struct ipv4_addr_key {
+       __be32  addr;
+       int     vif;
+};
+
 #define INETPEER_MAXKEYSZ   (sizeof(struct in6_addr) / sizeof(u32))
 
 struct inetpeer_addr {
        union {
-               __be32                  a4;
+               struct ipv4_addr_key    a4;
                struct in6_addr         a6;
                u32                     key[INETPEER_MAXKEYSZ];
        };
@@ -71,13 +77,13 @@ void inet_initpeers(void) __init;
 
 static inline void inetpeer_set_addr_v4(struct inetpeer_addr *iaddr, __be32 ip)
 {
-       iaddr->a4 = ip;
+       iaddr->a4.addr = ip;
        iaddr->family = AF_INET;
 }
 
 static inline __be32 inetpeer_get_addr_v4(struct inetpeer_addr *iaddr)
 {
-       return iaddr->a4;
+       return iaddr->a4.addr;
 }
 
 static inline void inetpeer_set_addr_v6(struct inetpeer_addr *iaddr,
@@ -99,11 +105,12 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
 
 static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
                                                __be32 v4daddr,
-                                               int create)
+                                               int vif, int create)
 {
        struct inetpeer_addr daddr;
 
-       daddr.a4 = v4daddr;
+       daddr.a4.addr = v4daddr;
+       daddr.a4.vif = vif;
        daddr.family = AF_INET;
        return inet_getpeer(base, &daddr, create);
 }

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index f16488efa1c8930c23aea42a770e935fa41578b2..79fe05befcae907c4374ba8a4a0773b26f41e320 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -309,9 +309,10 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
 
        rc = false;
        if (icmp_global_allow()) {
+               int vif = vrf_master_ifindex(dst->dev);
                struct inet_peer *peer;
 
-               peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1);
+               peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
                rc = inet_peer_xrlim_allow(peer,
                                           net->ipv4.sysctl_icmp_ratelimit);
                if (peer)

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 15762e758861b8d7101996a8faef749e2e8c7c3e..fa7f15305f9a2c1fa2f25d98047a161b6011ead1 100644 (file)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -151,7 +151,8 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
        qp->vif = arg->vif;
        qp->user = arg->user;
        qp->peer = sysctl_ipfrag_max_dist ?
-               inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, 1) : NULL;
+               inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) :
+               NULL;
 }
 
 static void ip4_frag_free(struct inet_frag_queue *q)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f3087aaa6dd86c7aad92814b53aa6cc6494292a1..6b91879e9cbe5e574ff562306472111a2fb66377 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -838,6 +838,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
        struct inet_peer *peer;
        struct net *net;
        int log_martians;
+       int vif;
 
        rcu_read_lock();
        in_dev = __in_dev_get_rcu(rt->dst.dev);
@@ -846,10 +847,11 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                return;
        }
        log_martians = IN_DEV_LOG_MARTIANS(in_dev);
+       vif = vrf_master_ifindex_rcu(rt->dst.dev);
        rcu_read_unlock();
 
        net = dev_net(rt->dst.dev);
-       peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
+       peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1);
        if (!peer) {
                icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
                          rt_nexthop(rt, ip_hdr(skb)->daddr));
@@ -938,7 +940,8 @@ static int ip_error(struct sk_buff *skb)
                break;
        }
 
-       peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
+       peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
+                              vrf_master_ifindex(skb->dev), 1);
 
        send = true;
        if (peer) {