netdev - [PATCH 0/5 net-next] Netfilter ingress support (v4)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1431533978-26901-1-git-send-email-pablo@netfilter.org>
Date:	Wed, 13 May 2015 18:19:33 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	netfilter-devel@...r.kernel.org
Cc:	davem@...emloft.net, netdev@...r.kernel.org, jhs@...atatu.com,
	daniel@...earbox.net, eric.dumazet@...il.com, kaber@...sh.net,
	ast@...mgrid.com
Subject: [PATCH 0/5 net-next] Netfilter ingress support (v4)

Hi,

This is the v4 round of patches to add the Netfilter ingress hook, it basically
comes in two steps:

1) Add the CONFIG_NET_INGRESS switch to wrap the ingress static key around it.
   The idea is to use the same global static key to avoid adding more code to
   the hot path.

2) Add the Netfilter ingress hook after the tc ingress hook, under the global
   ingress_needed static key. As I said, the netfilter ingress hook also has
   its own static key, that is nested under the global static key. Please, see
   patch 5/5 for performance numbers and more information.

I originally started this next round, as it was suggested, exploring the
independent static key for netfilter ingress just after tc ingress, but the
results that I gathered from that patch are not good for non-users:

Result: OK: 6425927(c6425843+d83) usec, 100000000 (60byte,0frags)
  15561955pps 7469Mb/sec (7469738400bps) errors: 100000000

this roughly means 500Kpps less performance wrt. the base numbers, so that's
the reason why I discarded that approach and I focused on this.

The idea of this patchset is to open the window to nf_tables, which comes with
features that will work out-of-the-box (once the boiler plate code to support
the 'netdev' table family is in place), to avoid repeating myself [1], the most
relevant features are:

1) Multi-dimensional key dictionary lookups.
2) Arbitrary stateful flow tables.
3) Transactions and good support for dynamic updates.

But there are also interest aspects to consider from userspace, such as the
ability to support new layer 2 protocols without kernel updates, a well-defined
netlink interface, userspace libraries and utilities for third party
applications, among others.

I hope we can be happy with this approach.

Please, apply. Thanks.

[1] http://marc.info/?l=netfilter-devel&m=143033337020328&w=2

Pablo Neira Ayuso (5):
  netfilter: cleanup struct nf_hook_ops indentation
  netfilter: add hook list to nf_hook_state
  netfilter: add nf_hook_list_active()
  net: add CONFIG_NET_INGRESS to enable ingress filtering
  netfilter: add netfilter ingress hook after handle_ing() under unique
    static key

 include/linux/netdevice.h         |    3 +++
 include/linux/netfilter.h         |   39 +++++++++++++++++++++------------
 include/linux/netfilter_ingress.h |   41 +++++++++++++++++++++++++++++++++++
 include/linux/rtnetlink.h         |    2 +-
 include/uapi/linux/netfilter.h    |    6 ++++++
 net/Kconfig                       |    3 +++
 net/core/dev.c                    |   43 ++++++++++++++++++++++++++++++++++---
 net/netfilter/Kconfig             |    7 ++++++
 net/netfilter/core.c              |   37 ++++++++++++++++++++++++++-----
 net/sched/Kconfig                 |    1 +
 10 files changed, 159 insertions(+), 23 deletions(-)
 create mode 100644 include/linux/netfilter_ingress.h

--
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html