netdev - Re: [PATCH net-next] tc: cls_bpf: make ingress and egress qdiscs consistent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <551F21A0.1030503@iogearbox.net>
Date:	Sat, 04 Apr 2015 01:26:24 +0200
From:	Daniel Borkmann <daniel@...earbox.net>
To:	Alexei Starovoitov <ast@...mgrid.com>,
	"David S. Miller" <davem@...emloft.net>
CC:	Jiri Pirko <jiri@...nulli.us>, Jamal Hadi Salim <jhs@...atatu.com>,
	linux-api@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] tc: cls_bpf: make ingress and egress qdiscs
 consistent

On 04/04/2015 01:11 AM, Alexei Starovoitov wrote:
> On 4/3/15 4:04 PM, Alexei Starovoitov wrote:
>> On 4/3/15 3:54 PM, Daniel Borkmann wrote:
...
>>> I see the point regarding the user option. So, why not adding a flag
>>> to tcf_proto_ops a la `.flags = CLS_REQUIRES_L2` that gets propagated
>>> to tcf_proto, and only ingress_enqueue() would need to test if the
>>> classifier imposes that requirement, so it can push/pull.
>>
>> ok. that sounds better, but neither tcf_proto nor tcf_proto_ops have
>> 'flags' field today... well, I guess it's time to add flags there.

I don't think it would be a big problem.

>> Probably add 'flags' to tcf_proto_ops only and do fl->ops->flags in
>> ingress_enqueue()?

Something along that line, yeah.

>> Will respin.
>
> nope. will take it back.
> that doesn't work, since this check cannot be done in ingress_enqueue(),
> because it sees the pointer to first filter only, so both TCQ_F_INGRESS
> flag and CLS_REQUIRES_L2 flag need to be checked inside

So on a quick glance, we're calling into cls_bpf_classify() in tp->classify()
(net/sched/cls_api.c +265), so all remaining filters in that list we're
traversing in cls_bpf_classify() are all BPF filters, no?

Have to grab some sleep for now, will be on travel tomorrow. Anyway, worst
case it could still be refactored later.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html