netdev - Re: [patch net-next v7 09/13] net: sched: allow ingress and clsact qdiscs to share filter blocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180111161155.GP2053@nanopsycho.orion>
Date:   Thu, 11 Jan 2018 17:11:55 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     Roopa Prabhu <roopa@...ulusnetworks.com>
Cc:     Jamal Hadi Salim <jhs@...atatu.com>, netdev@...r.kernel.org,
        David Miller <davem@...emloft.net>,
        Cong Wang <xiyou.wangcong@...il.com>,
        mlxsw <mlxsw@...lanox.com>, Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...oirfairelinux.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Michael Chan <michael.chan@...adcom.com>, ganeshgr@...lsio.com,
        Saeed Mahameed <saeedm@...lanox.com>, matanb@...lanox.com,
        leonro@...lanox.com, Ido Schimmel <idosch@...lanox.com>,
        jakub.kicinski@...ronome.com,
        Simon Horman <simon.horman@...ronome.com>,
        pieter.jansenvanvuuren@...ronome.com, john.hurley@...ronome.com,
        Alexander Duyck <alexander.h.duyck@...el.com>,
        Or Gerlitz <ogerlitz@...lanox.com>,
        John Fastabend <john.fastabend@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        David Ahern <dsahern@...il.com>
Subject: Re: [patch net-next v7 09/13] net: sched: allow ingress and clsact
 qdiscs to share filter blocks

Thu, Jan 11, 2018 at 04:41:27PM CET, roopa@...ulusnetworks.com wrote:
>On Thu, Jan 11, 2018 at 7:07 AM, Jiri Pirko <jiri@...nulli.us> wrote:
>> Thu, Jan 11, 2018 at 03:46:09PM CET, jhs@...atatu.com wrote:
>>>On 18-01-11 09:41 AM, Jiri Pirko wrote:
>>>> Thu, Jan 11, 2018 at 03:37:08PM CET, jhs@...atatu.com wrote:
>>>> > On 18-01-11 09:24 AM, Jiri Pirko wrote:
>>>> > > Thu, Jan 11, 2018 at 02:36:01PM CET, jhs@...atatu.com wrote:
>>>> > > > On 18-01-09 09:07 AM, Jiri Pirko wrote:
>>>> > > > > From: Jiri Pirko <jiri@...lanox.com>
>>>> > > > >
>>>> > > > > Benefit from the previously introduced shared filter blocks
>>>> > > > > infrastructure and allow ingress and clsact qdisc instances to share
>>>> > > > > filter blocks. The block index is coming from userspace as qdisc option.
>>>> > > >
>>>> > > > Didnt quiet follow why ingress is special and needs attributes to
>>>> > > > set the block but other qdiscs didnt.
>>>> > >
>>>> > > Jamal, again, other qdiscs does not support block sharing. This patchset
>>>> > > only adds support for sharing of block for ingress and clsact qdiscs.
>>>> > > Later on, other qdiscs could also support block sharing.
>>>> > >
>>>> >
>>>> > Can you stop a config which says:
>>>> > tc qdisc add dev ens9 root block 22 handle 1:0 prio ?
>>>>
>>>> Please see the iproute2 patches. Parsing of "block" command line option
>>>> is done inside q_ingress.c
>>>>
>>>
>>>I only looked at the kernel code. Good you can stop it at tc
>>>but the API does not stop it (unless you expect the rest of the
>>>world to only use tc).
>>
>> Jamal, apparently, you did not looked at the kernel code either :)
>> Look at the changes done in net/sched/sch_ingress.c - there is where the
>> parsing of block attr takes place.
>>
>>
>>>Really - there is no reason for this API to be only via ingress qdisc
>>>attributes. You can add a check in cls api to reject any parent that is
>>>not either of the clsacts + ingress (depending on tc doesnt sound
>>>right).
>>
>> I was thinking to take this direction originally. To have another
>> generic attr called TCA_BLOCK or something that would be used when qdisc
>> is created. For ingress, what would work. But for clsact, you need to be
>> able to specify 2 block during qdisc creation - one for ingress, one for
>> egress. That's when I realized this has to be per-qdisc-type attr.
>
>
>yeah, see the problem...but.., would it help if we just introduce two
>generic attrs TCA_BLOCK_INGRESS and TCA_BLOCK_EGRESS instead of having
>to duplicate these attrs at every qdisc ?.
>and add proper validation depending on qdisc type..

I guess it would make sense. I just did not want to introduce this
limitation. But allright. Will do this.