linux-kernel - Re: [PATCH net-next 1/3] net: ip: add skb drop reasons for ip egress path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADxym3aMn_h_x0HYopDRu8y_sgRii+=myFtVr8iAYYxJuT2_JA@mail.gmail.com>
Date:   Tue, 22 Feb 2022 11:44:24 +0800
From:   Menglong Dong <menglong8.dong@...il.com>
To:     David Ahern <dsahern@...nel.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...hat.com>,
        David Miller <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Menglong Dong <imagedong@...cent.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Alexander Lobakin <alobakin@...me>,
        Cong Wang <cong.wang@...edance.com>, paulb@...dia.com,
        Talal Ahmad <talalahmad@...gle.com>,
        Kees Cook <keescook@...omium.org>,
        Ilias Apalodimas <ilias.apalodimas@...aro.org>,
        Kumar Kartikeya Dwivedi <memxor@...il.com>,
        flyingpeng@...cent.com, Mengen Sun <mengensun@...cent.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Yajun Deng <yajun.deng@...ux.dev>,
        Roopa Prabhu <roopa@...dia.com>,
        LKML <linux-kernel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next 1/3] net: ip: add skb drop reasons for ip egress path

On Tue, Feb 22, 2022 at 11:13 AM David Ahern <dsahern@...nel.org> wrote:
>
> On 2/20/22 8:57 AM, menglong8.dong@...il.com wrote:
> > From: Menglong Dong <imagedong@...cent.com>
> >
> > Replace kfree_skb() with kfree_skb_reason() in the packet egress path of
> > IP layer (both IPv4 and IPv6 are considered).
> >
> > Following functions are involved:
> >
> > __ip_queue_xmit()
> > ip_finish_output()
> > ip_mc_finish_output()
> > ip6_output()
> > ip6_finish_output()
> > ip6_finish_output2()
> >
> > Following new drop reasons are introduced:
> >
> > SKB_DROP_REASON_IP_OUTNOROUTES
> > SKB_DROP_REASON_BPF_CGROUP_EGRESS
> > SKB_DROP_REASON_IPV6DSIABLED
> >
> > Reviewed-by: Mengen Sun <mengensun@...cent.com>
> > Reviewed-by: Hao Peng <flyingpeng@...cent.com>
> > Signed-off-by: Menglong Dong <imagedong@...cent.com>
> > ---
> >  include/linux/skbuff.h     | 13 +++++++++++++
> >  include/trace/events/skb.h |  4 ++++
> >  net/ipv4/ip_output.c       |  6 +++---
> >  net/ipv6/ip6_output.c      |  6 +++---
> >  4 files changed, 23 insertions(+), 6 deletions(-)
> >
> > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> > index a3e90efe6586..c310a4a8fc86 100644
> > --- a/include/linux/skbuff.h
> > +++ b/include/linux/skbuff.h
> > @@ -380,6 +380,19 @@ enum skb_drop_reason {
> >                                        * the ofo queue, corresponding to
> >                                        * LINUX_MIB_TCPOFOMERGE
> >                                        */
> > +     SKB_DROP_REASON_IP_OUTNOROUTES, /* route lookup failed during
> > +                                      * packet outputting
> > +                                      */
>
> This should be good enough since the name contains OUT.
>
> /* route lookup failed */
>
> > +     SKB_DROP_REASON_BPF_CGROUP_EGRESS,      /* dropped by eBPF program
> > +                                              * with type of BPF_PROG_TYPE_CGROUP_SKB
> > +                                              * and attach type of
> > +                                              * BPF_CGROUP_INET_EGRESS
> > +                                              * during packet sending
> > +                                              */
>
> /* dropped by BPF_CGROUP_INET_EGRESS eBPF program */
>
> > +     SKB_DROP_REASON_IPV6DSIABLED,   /* IPv6 is disabled on the device,
> > +                                      * see the doc for disable_ipv6
> > +                                      * in ip-sysctl.rst for detail
> > +                                      */
>
> Just /* IPv6 is disabled on the device */
>
>
> >       SKB_DROP_REASON_MAX,
> >  };
> >
>
> > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> > index 0c0574eb5f5b..df549b7415fb 100644
> > --- a/net/ipv4/ip_output.c
> > +++ b/net/ipv4/ip_output.c
>
> This file has other relevant drops. e.g., ip_finish_output2 when a neigh
> entry can not be created and after skb_gso_segment. The other set for
> tun/tap devices has SKB_DROP_REASON_SKB_GSO_SEG which can be used for
> the latter. That set also adds kfree_skb_list_reason for the frag drops.
>

I tried to add a drop reason for neigh creating fail, but I found it's hard
to find the root reason, as __neigh_create() can fail in many cases.
And I'm not sure if there is any help when we get a
'SKB_DROP_REASON_NEIGH_CREATEFAIL' message.

Seems it's hard to make every drop reason accurate, is it ok if we
use the name 'SKB_DROP_REASON_NEIGH_CREATEFAIL' for
this path?

>
> > diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> > index 0c6c971ce0a5..4cd9e5fd25e4 100644
> > --- a/net/ipv6/ip6_output.c
> > +++ b/net/ipv6/ip6_output.c
>
> Similarly here. The other set should land in the next few days, so you
> cna put this set on top of it.

Yeah, I can make use of it.

>