netdev - Re: Using skb->mark outside netfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5188FBD2.5090200@mojatatu.com>
Date:	Tue, 07 May 2013 09:04:18 -0400
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Antonio Quartulli <antonio@...n-mesh.com>
CC:	"David S. Miller" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: Using skb->mark outside netfilter

On 13-05-06 02:48 PM, Antonio Quartulli wrote:

>
> Now to extend this mechanism network-wide (remember that the use case is a Layer2
> mesh network set up with batman-adv) I'm going to introduce a mechanism in
> batman-adv itself which is supposed to read and write the skb->mark field
> so that the value contained when the packet is leaving one end can be restored
> later on the other end of the intra-mesh communication (only if it matches a pre
> configured one).
> This would allow the remote node to perform the same filtering
> operation as if the packet was locally generated.
>

Nice idea.
How do you encode the mark in the batman header?

> Now my question is (I think David is the one who should probably decide here):
> is batman-adv allowed to touch the mark field of the sk_buff structure? Or is it
> reserved for netfilter purposes only?
>

Ok, let me see if i can come up with a definition for mark:
"A general purpose 32 bit tag used in the network subsystem
to carry metadata with global implications across network
sub-subsystem. As an example, a driver could mark on incoming
packet to be used by the ingress tc classifier-action sub-subsystem,
netfilter, ipsec all to execute provisioned policies. Since marks
have global implications, any changes in the datapath flow would
have repurcassions at each sub-subsytem level the packet flows to
next.
The mark could also be used to direct packets to matching socket
apps (eg tcp applications) which have registered for it ......
... more text here on how the mark is used for egress ...
"

So please, use it.

> In my opinion this field (which survives whatever path the skb follows) is the
> best option for this task as it allows batman-adv to "communicate" with
> tc and possibly netfilter itself (if in the future users would like to perform
> more complicated operations).
>

Yes. Also apps which setsockopt to it etc

>
> To clarify the idea, here you have an ascii art representing a possible setup
> and how the mark will be read and set:

Looks sane to me.

cheers,
jamal

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html