netdev - Re: [PATCH net-next 4/5] ipv4: route: dissect flow in input path if fib rules need it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <26d334f7-2ee6-7d7b-445b-aa85a2d06a33@cumulusnetworks.com>
Date:   Sun, 25 Feb 2018 20:17:48 -0700
From:   David Ahern <dsa@...ulusnetworks.com>
To:     Roopa Prabhu <roopa@...ulusnetworks.com>, davem@...emloft.net,
        netdev@...r.kernel.org
Cc:     nikolay@...ulusnetworks.com, idosch@...lanox.com
Subject: Re: [PATCH net-next 4/5] ipv4: route: dissect flow in input path if
 fib rules need it

On 2/24/18 10:44 PM, Roopa Prabhu wrote:
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 26eefa2..72dd6c6 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -1783,7 +1783,7 @@ static void ip_multipath_l3_keys(const struct sk_buff *skb,
>  
>  /* if skb is set it will be used and fl4 can be NULL */

update that comment for flow_keys.

>  int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4,
> -		       const struct sk_buff *skb)
> +		       const struct sk_buff *skb, struct flow_keys *flkeys)
>  {
>  	struct net *net = fi->fib_net;
>  	struct flow_keys hash_keys;
> @@ -1810,14 +1810,23 @@ int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4,
>  			if (skb->l4_hash)
>  				return skb_get_hash_raw(skb) >> 1;
>  			memset(&hash_keys, 0, sizeof(hash_keys));
> -			skb_flow_dissect_flow_keys(skb, &keys, flag);
>  
> -			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> -			hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src;
> -			hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst;
> -			hash_keys.ports.src = keys.ports.src;
> -			hash_keys.ports.dst = keys.ports.dst;
> -			hash_keys.basic.ip_proto = keys.basic.ip_proto;
> +			if (flkeys) {
> +				hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> +				hash_keys.addrs.v4addrs.src = flkeys->addrs.v4addrs.src;
> +				hash_keys.addrs.v4addrs.dst = flkeys->addrs.v4addrs.dst;
> +				hash_keys.ports.src = flkeys->ports.src;
> +				hash_keys.ports.dst = flkeys->ports.dst;
> +				hash_keys.basic.ip_proto = flkeys->basic.ip_proto;
> +			} else {
> +				skb_flow_dissect_flow_keys(skb, &keys, flag);
> +				hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> +				hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src;
> +				hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst;
> +				hash_keys.ports.src = keys.ports.src;
> +				hash_keys.ports.dst = keys.ports.dst;
> +				hash_keys.basic.ip_proto = keys.basic.ip_proto;
> +			}
>  		} else {
>  			memset(&hash_keys, 0, sizeof(hash_keys));
>  			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
> @@ -1838,11 +1847,12 @@ int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4,
>  static int ip_mkroute_input(struct sk_buff *skb,
>  			    struct fib_result *res,
>  			    struct in_device *in_dev,
> -			    __be32 daddr, __be32 saddr, u32 tos)
> +			    __be32 daddr, __be32 saddr, u32 tos,
> +			    struct flow_keys *hkeys)
>  {
>  #ifdef CONFIG_IP_ROUTE_MULTIPATH
>  	if (res->fi && res->fi->fib_nhs > 1) {
> -		int h = fib_multipath_hash(res->fi, NULL, skb);
> +		int h = fib_multipath_hash(res->fi, NULL, skb, hkeys);
>  
>  		fib_select_multipath(res, h);
>  	}
> @@ -1868,13 +1878,14 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
>  			       struct fib_result *res)
>  {
>  	struct in_device *in_dev = __in_dev_get_rcu(dev);
> +	struct flow_keys *flkeys = NULL, _flkeys;
> +	struct net    *net = dev_net(dev);
>  	struct ip_tunnel_info *tun_info;
> -	struct flowi4	fl4;
> +	int		err = -EINVAL;
>  	unsigned int	flags = 0;
>  	u32		itag = 0;
>  	struct rtable	*rth;
> -	int		err = -EINVAL;
> -	struct net    *net = dev_net(dev);
> +	struct flowi4	fl4;
>  	bool do_cache;
>  
>  	/* IP on this device is disabled. */
> @@ -1933,6 +1944,19 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
>  	fl4.daddr = daddr;
>  	fl4.saddr = saddr;
>  	fl4.flowi4_uid = sock_net_uid(net, NULL);
> +
> +#ifdef CONFIG_IP_MULTIPLE_TABLES
> +	if (net->ipv4.fib_rules_require_fldissect) {
> +		unsigned int flag = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
> +
> +		memset(&_flkeys, 0, sizeof(_flkeys));
> +		skb_flow_dissect_flow_keys(skb, &_flkeys, flag);
> +		fl4.fl4_sport = _flkeys.ports.src;
> +		fl4.fl4_dport = _flkeys.ports.dst;
> +		fl4.flowi4_proto = _flkeys.basic.ip_proto;
> +		flkeys = &_flkeys;
> +	}
> +#endif

I think a helper that compiles out if the config is disabled would be
better; this function is already long enough.


>  	err = fib_lookup(net, &fl4, res, 0);
>  	if (err != 0) {
>  		if (!IN_DEV_FORWARD(in_dev))
> @@ -1958,7 +1982,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
>  	if (res->type != RTN_UNICAST)
>  		goto martian_destination;
>  
> -	err = ip_mkroute_input(skb, res, in_dev, daddr, saddr, tos);
> +	err = ip_mkroute_input(skb, res, in_dev, daddr, saddr, tos, flkeys);
>  out:	return err;
>  
>  brd_input:
>