netdev - Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter ingress hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Apr 2015 23:02:57 -0700
From:	Alexei Starovoitov <alexei.starovoitov@...il.com>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	Jamal Hadi Salim <jhs@...atatu.com>,
	Daniel Borkmann <daniel@...earbox.net>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org
Subject: Re: [PATCH 6/6] net: move qdisc ingress filtering on top of
 netfilter ingress hooks

On Thu, Apr 30, 2015 at 06:05:37AM +0200, Patrick McHardy wrote:

> 06:05:37AM

do you ever sleep? ;)

> For the sake of completeness - on ingress, this alternativ means simply
> ditching TC. 

I'm sure 'ditching TC' doesn't mean to kill ingress qdisc
completely. Compatibility needs to be preserved.

What I'm doing in my 'experimental ingress qdisc' acceleration
boils down to:
@@ -1649,6 +1649,7 @@ struct net_device {
        rx_handler_func_t __rcu *rx_handler;
        void __rcu              *rx_handler_data;

-       struct netdev_queue __rcu *ingress_queue;
+       struct tcf_proto __rcu  *ingress_filter_list;

so to call tc_classify() and reach cls_bpf I don't need to walk
down skb->dev->ingress_queue->qdisc->enqueue/qdisc_priv->filter_list
and can just do skb->dev->ingress_filter_list
and can skip several unnecessary deref like sch->stab, skb->len, etc.
Both ingress_queue and ingress qdisc are no longer allocated
and stay only as a shim to preserve uapi.

My point is that I agree that cleanup of ingress qdisc is needed.
I disagree with drastic measures.
Just add your nf_hook to ingress and let's see how things evolve.
We have rx_handler and all of ptype hooks in there. One can argue
that rx_handler overlaps with nf_hook too ? ;)
We cannot generalize them all under one 'hook' infra.
nf needs to do nf_hook_state_init() and pass it around which
no one else needs. That's the cost others should not pay.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html