netdev - [PATCH net-next] tc: cls_bpf: make ingress and egress qdiscs consistent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1428095784-7091-1-git-send-email-ast@plumgrid.com>
Date:	Fri,  3 Apr 2015 14:16:24 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	"David S. Miller" <davem@...emloft.net>
Cc:	Daniel Borkmann <daniel@...earbox.net>,
	Jiri Pirko <jiri@...nulli.us>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	linux-api@...r.kernel.org, netdev@...r.kernel.org
Subject: [PATCH net-next] tc: cls_bpf: make ingress and egress qdiscs consistent

BPF programs attached to ingress and egress qdiscs see inconsistent skb->data.
For ingress L2 header is already pulled, whereas for egress it's present.
That makes writing programs more difficult.
Make them consistent by pushing L2 before running the programs and pulling
it back afterwards.
Similar approach is taken by skb_defer_rx_timestamp() which does push/pull
before calling ptp_classify_raw()->BPF_PROG_RUN().

Signed-off-by: Alexei Starovoitov <ast@...mgrid.com>
---

Looks like noone has tried bpf with ingress qdisc before, otherwise this
problem would have been found sooner.
This patch is probably not needed for 'net', since tc+bpf infra only starting
to come alive.

 net/sched/cls_bpf.c |    9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 5c4171c5d2bd..b1cefd2037c9 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -66,6 +66,12 @@ static int cls_bpf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 	struct cls_bpf_prog *prog;
 	int ret = -1;
 
+	if (tp->q->flags & TCQ_F_INGRESS) {
+		if (skb_headroom(skb) < ETH_HLEN)
+			return -1;
+		__skb_push(skb, ETH_HLEN);
+	}
+
 	/* Needed here for accessing maps. */
 	rcu_read_lock();
 	list_for_each_entry_rcu(prog, &head->plist, link) {
@@ -86,6 +92,9 @@ static int cls_bpf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 	}
 	rcu_read_unlock();
 
+	if (tp->q->flags & TCQ_F_INGRESS)
+		__skb_pull(skb, ETH_HLEN);
+
 	return ret;
 }
 
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html