lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20170313135006.GA4463@penelope.horms.nl> Date: Mon, 13 Mar 2017 14:50:08 +0100 From: Simon Horman <simon.horman@...ronome.com> To: Jiri Pirko <jiri@...nulli.us> Cc: David Miller <davem@...emloft.net>, Dinan Gunawardena <dinan.gunawardena@...ronome.com>, netdev@...r.kernel.org, oss-drivers@...ronome.com Subject: Re: [PATCH/RFC net-next 1/2] flow dissector: ND support On Fri, Mar 10, 2017 at 03:27:32PM +0100, Jiri Pirko wrote: > Fri, Mar 10, 2017 at 03:19:13PM CET, simon.horman@...ronome.com wrote: > >On Tue, Feb 21, 2017 at 04:28:10PM +0100, Jiri Pirko wrote: > >> Thu, Feb 02, 2017 at 11:37:34AM CET, simon.horman@...ronome.com wrote: > >> >Allow dissection of Neighbour Discovery target IP, and source and > >> >destination link-layer addresses for neighbour solicitation and > >> >advertisement messages. > >> > > >> >Signed-off-by: Simon Horman <simon.horman@...ronome.com> > >> >--- > >> > >> [...] > >> > >> >@@ -633,6 +702,18 @@ bool __skb_flow_dissect(const struct sk_buff *skb, > >> > FLOW_DISSECTOR_KEY_ICMP, > >> > target_container); > >> > key_icmp->icmp = skb_flow_get_be16(skb, nhoff, data, hlen); > >> >+ > >> >+ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ND) && > >> >+ ip_proto == IPPROTO_IPV6 && key_icmp->code == 0 && > >> > >> IPPROTO_IPV6 say "IPv6-in-IPv4 tunnelling". Please use "NEXTHDR_IPV6" > >> instead. > > > >Thanks, will do. > > > >> >+ (key_icmp->type == NDISC_NEIGHBOUR_SOLICITATION || > >> >+ key_icmp->type == NDISC_NEIGHBOUR_ADVERTISEMENT)) { > >> >+ key_nd = skb_flow_dissector_target(flow_dissector, > >> >+ FLOW_DISSECTOR_KEY_ND, > >> >+ target_container); > >> >+ if (!(skb_flow_dissect_nd(skb, key_nd, data, nhoff, > >> >+ hlen, ipv6_payload_len))) > >> >+ goto out_bad; > >> >+ } > >> > >> You should put this under "switch (ip_proto) {" > > > >I see that makes sense in terms of the check against ip_proto. > >But I added it here to allow checking against key_icmp->code > >and key_icmp->type as well. > > Sure. Just add under "switch (ip_proto) {" and call a wrapper nd > function from there. In that function, you check dissector_uses_key and > other needed things. Hi Jiri, I'm sorry but I'm having a bit of trouble understanding how best to structure the extraction of ICMP and ND. The way I see things is this: * ICMP extraction may occur for IPv4 or IPv6 although currently neither IPv4 nor IPv6 is a condition of ICMP extraction. * ND extraction may only occur for IPv6 * ND extraction may only occur for certain ICMP code/type values; thus ICMP extraction should occur before ND extraction. I wonder if a good alternative to the approach I took above in my patch would be to provide: * ICMP extraction conditional on IPv4 and; * ICMP extraction conditional on IPv6 followed by ND extraction conditional on ICMP type and code
Powered by blists - more mailing lists