netdev - Re: (Lack of) specification for RX n-tuple filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1291835644.2560.52.camel@bwh-desktop>
Date:	Wed, 08 Dec 2010 19:14:04 +0000
From:	Ben Hutchings <bhutchings@...arflare.com>
To:	Dimitris Michailidis <dm@...lsio.com>
Cc:	Vladislav Zolotarov <vladz@...adcom.com>,
	Peter Waskiewicz <peter.p.waskiewicz.jr@...el.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>
Subject: Re: (Lack of) specification for RX n-tuple filtering

On Wed, 2010-12-08 at 10:54 -0800, Dimitris Michailidis wrote:
> Ben Hutchings wrote:
> > On Wed, 2010-12-08 at 18:24 +0200, Vladislav Zolotarov wrote:
> >>>> It's a bit worse than that.  Currently one can only append filters, not
> >>>> insert at a given position, as ethtool_rx_ntuple doesn't have an index
> >>>> field.  For devices that use TCAMs, where position matters, it's quite an
> >>>> obstacle.  It also means one cannot modify an existing filter by specifying
> >>>> a new filter for the same index.
> >>> It looks like drivers for devices that use TCAMs should implement the
> >>> RXNFC interface instead.
> >>>
> >> Ben, from ethtool manpage it sounds like RXNFC option defines the way
> >> the RSS hash should be calculated, while SRXNTUPLE is meant to control
> >> the destination Rx queue for a stream specified by a filter/filters.
> > 
> > By 'RXNFC interface' I mean ETHTOOL_{G,S}RXCLS* and not
> > ETHTOOL_{G,S}RXFH which wrongly share (part of) the same structure..
> > 
> >> The
> >> semantics for a specification of the steam is also quite different. For
> >> instance, how do u define a rule to drop all packets with source IP
> >> address 192.168.10.200 by means of RXNFC?
> > 
> > Something like this, I think:
> > 
> > struct ethtool_rxnfc insert_rule = {
> > 	.cmd = ETHTOOL_SRXCLSRLINS,
> > 	.flow_type = IP_USER_SPEC,
> > 	.fs = {
> > 		.flow_type = IP_USER_SPEC,
> > 		.h_u.usr_ip4_spec = {
> > 			.ip4src = inet_aton("192.168.10.200"),
> > 			.ip_ver = ETH_RX_NFC_IP4
> > 		},
> > 		.m_u.usr_ip4_spec = {
> > 			.ip4dst = 0xffffffff,
> > 			.l4_4_bytes = 0xffffffff,
> > 			.tos = 0xff,
> > 			.proto = 0xff
> > 		},
> > 		.ring_cookie = RX_CLS_FLOW_DISC,
> > 		.location = 0,
> > 	}
> > };
> 
> I think the mask would be 0 for don't care fields and 1 for care, so
> 
> 	.m_u.usr_ip4_spec.ip4src = htonl(0xffffffff)
> 	.m_u.usr_ip4_spec.ip4dst = htonl(0)
> etc

That is definitely the opposite of what ixgbe and sfc do for
ethtool_ntuple_rx_flow_spec, and I believe it is the opposite of what
niu does for ethtool_rx_flow_spec.

[...]
> >> It's also unclear what is the relation between RXNFC and SRXNTUPLE. The
> >> last in general may override the decision made based on the hash result.
> >> So, it sounds like applying rules of SRXNTUPLE should come before
> >> applying the RSS logic and only if there was no match RSS should be
> >> applied to that frame. Do I get it right?
> > 
> > That's right.
> 
> It can be more involved than this.  Our HW allows a rule to select a 
> different part of the RSS table so you get a filter hit and still do RSS 
> afterwards if you want.  Current ethtool interfaces do not support this, 
> basically it would be a different action for either SRXNTUPLE or SRXCLSRLINS.

So does the rule specify an offset added to the output of the RSS hash
and indirection table, or can it also select a different indirection
table?  Our current hardware also has a filter flag for the former
behaviour...  There are still plenty of bits to spare in 'action' and
'ring_cookie' so perhaps we could define a flag for this?

Ben.

-- 
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html