netdev - Re: [RFC bpf-next 8/9] bpf: Provide helper to do lookups in kernel FIB table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 27 Apr 2018 10:49:35 -0600
From:   David Ahern <dsahern@...il.com>
To:     Martin KaFai Lau <kafai@...com>
Cc:     netdev@...r.kernel.org, borkmann@...earbox.net, ast@...nel.org,
        shm@...ulusnetworks.com, roopa@...ulusnetworks.com,
        brouer@...hat.com, toke@...e.dk, john.fastabend@...il.com
Subject: Re: [RFC bpf-next 8/9] bpf: Provide helper to do lookups in kernel
 FIB table

On 4/27/18 10:43 AM, Martin KaFai Lau wrote:
>> +#if IS_ENABLED(CONFIG_IPV6)
>> +static int bpf_ipv6_fib_lookup(struct xdp_buff *ctx,
>> +			       struct bpf_fib_lookup *params, u32 flags)
>> +{
>> +	struct net *net = dev_net(ctx->rxq->dev);
>> +	struct neighbour *neigh;
>> +	struct net_device *dev;
>> +	struct fib6_info *f6i;
>> +	struct flowi6 fl6;
>> +	int strict = 0;
>> +	int oif;
>> +
>> +	/* link local addresses are never forwarded */
>> +	if (rt6_need_strict(&params->ipv6_dst) ||
>> +	    rt6_need_strict(&params->ipv6_src))
>> +		return 0;
>> +
>> +	dev = dev_get_by_index_rcu(net, params->ifindex);
>> +	if (unlikely(!dev))
>> +		return -ENODEV;
>> +
>> +	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
>> +		fl6.flowi6_iif = 1;
> 1 is for LOOPBACK_IFINDEX?

yes. The intention is to mirror the flow struct created by full stack so
that routing in bpf == routing in IPv6 stack. ip6_route_output_flags
sets flowi6_iif to 1, so I repeated it here.

> 
>> +		oif = fl6.flowi6_oif = params->ifindex;
>> +	} else {
>> +		oif = fl6.flowi6_iif = params->ifindex;
>> +		fl6.flowi6_oif = 0;
>> +		strict = RT6_LOOKUP_F_HAS_SADDR;
>> +	}