| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <531EE5A2.7090501@redhat.com> Date: Tue, 11 Mar 2014 11:29:54 +0100 From: Daniel Borkmann <dborkman@...hat.com> To: Pablo Neira Ayuso <pablo@...filter.org> CC: netfilter-devel@...r.kernel.org, davem@...emloft.net, netdev@...r.kernel.org, kaber@...sh.net, Alexei Starovoitov <ast@...mgrid.com>, Eric Dumazet <eric.dumazet@...il.com> Subject: Re: [PATCH RFC 0/9] socket filtering using nf_tables On 03/11/2014 10:19 AM, Pablo Neira Ayuso wrote: > Hi! > > The following patchset provides a socket filtering alternative to BPF > which allows you to define your filter using the nf_tables expressions. > > Similarly to BPF, you can attach filters via setsockopt() > SO_ATTACH_NFT_FILTER. The filter that is passed to the kernel is > expressed in netlink TLV format which looks like: > > expression list (nested attribute) > expression element (nested attribute) > expression name (string) > expression data (nested attribute) > ... specific attribute for this expression go here > > This is similar to the netlink format of the nf_tables rules, so we > can re-use most of the infrastructure that we already have in userspace. > The kernel takes the TLV representation and translates it to the native > nf_tables representation. > > The patches 1-3 have helped to generalize the existing socket filtering > infrastructure to allow pluging new socket filtering frameworks. Then, > patches 4-8 generalize the nf_tables code by move the neccessary nf_tables > expression and data initialization core infrastructure. Then, patch 9 > provides the nf_tables socket filtering capabilities. > > Patrick and I have been discussing for a while that part of this > generalisation works should also help to add support for providing a > replacement to the tc framework, so with the necessary work, nf_tables > may provide in the near future packet a single packet classification > framework for Linux. I'm being curious here ;) as there's currently an ongoing effort on netdev for Alexei's eBPF engine (part 1 at [1,2,3]), which addresses shortcomings of current BPF and shall long term entirely replace the current BPF engine code to let filters entirely run in eBPF resp. eBPF's JIT engine, as I understand, which is also transparently usable in cls_bpf for classification in tc w/o rewriting on a different filter language. Performance figures have been posted/provided in [1] as well. So the plan on your side would be to have an alternative to eBPF, or build on top of it to reuse its in-kernel JIT compiler? [1] http://patchwork.ozlabs.org/patch/328927/ [2] http://patchwork.ozlabs.org/patch/328926/ [3] http://patchwork.ozlabs.org/patch/328928/ > There is an example of the userspace code available at: > > http://people.netfilter.org/pablo/nft-sock-filter-test.c > > I'm currently reusing the existing libnftnl interfaces, my plan is to > new interfaces in that library for easier and more simple filter > definition for socket filtering. > > Note that the current nf_tables expression-set is also limited with > regards to BPF, but the infrastructure that we have can be easily > extended with new expressions. > > Comments welcome! > > Pablo Neira Ayuso (9): > net: rename fp->bpf_func to fp->run_filter > net: filter: account filter length in bytes > net: filter: generalise sk_filter_release > netfilter: nf_tables: move fast operations to header > netfilter: nf_tables: add nft_value_init > netfilter: nf_tables: rename nf_tables_core.c to nf_tables_nf.c > netfilter: nf_tables: move expression infrastructure to built-in core > netfilter: nf_tables: generalize verdict handling and introduce scopes > netfilter: nf_tables: add support for socket filtering > > arch/arm/net/bpf_jit_32.c | 25 +- > arch/powerpc/net/bpf_jit_comp.c | 10 +- > arch/s390/net/bpf_jit_comp.c | 16 +- > arch/sparc/net/bpf_jit_comp.c | 8 +- > arch/x86/net/bpf_jit_comp.c | 8 +- > include/linux/filter.h | 28 +- > include/net/netfilter/nf_tables.h | 27 +- > include/net/netfilter/nf_tables_core.h | 84 +++++ > include/net/netfilter/nft_reject.h | 3 +- > include/net/sock.h | 8 +- > include/uapi/asm-generic/socket.h | 4 + > net/core/filter.c | 28 +- > net/core/sock.c | 19 ++ > net/core/sock_diag.c | 4 +- > net/netfilter/Kconfig | 13 + > net/netfilter/Makefile | 9 +- > net/netfilter/nf_tables_api.c | 440 ++++--------------------- > net/netfilter/nf_tables_core.c | 564 +++++++++++++++++++++----------- > net/netfilter/nf_tables_nf.c | 189 +++++++++++ > net/netfilter/nf_tables_sock.c | 327 ++++++++++++++++++ > net/netfilter/nft_bitwise.c | 35 +- > net/netfilter/nft_byteorder.c | 28 +- > net/netfilter/nft_cmp.c | 43 ++- > net/netfilter/nft_compat.c | 6 +- > net/netfilter/nft_counter.c | 3 +- > net/netfilter/nft_ct.c | 9 +- > net/netfilter/nft_exthdr.c | 3 +- > net/netfilter/nft_hash.c | 12 +- > net/netfilter/nft_immediate.c | 35 +- > net/netfilter/nft_limit.c | 3 +- > net/netfilter/nft_log.c | 3 +- > net/netfilter/nft_lookup.c | 3 +- > net/netfilter/nft_meta.c | 51 ++- > net/netfilter/nft_nat.c | 3 +- > net/netfilter/nft_payload.c | 29 +- > net/netfilter/nft_queue.c | 3 +- > net/netfilter/nft_rbtree.c | 12 +- > net/netfilter/nft_reject.c | 3 +- > 38 files changed, 1416 insertions(+), 682 deletions(-) > create mode 100644 net/netfilter/nf_tables_nf.c > create mode 100644 net/netfilter/nf_tables_sock.c > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists