netdev - Re: [PATCH bpf-next v3 3/6] bpf: Add IPv6 Segment Routing helpers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180509015753.yk6jpvr33i6xsq6y@ast-mbp>
Date:   Tue, 8 May 2018 18:57:54 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Mathieu Xhonneux <m.xhonneux@...il.com>
Cc:     David Lebrun <dlebrun@...gle.com>, netdev@...r.kernel.org,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH bpf-next v3 3/6] bpf: Add IPv6 Segment Routing helpers

On Mon, May 07, 2018 at 11:21:11PM +0100, Mathieu Xhonneux wrote:
> I'm not sure what would be the best approach here. These errors appear
> when CONFIG_IPV6=m and CONFIG_IPV6_SEG6_LWTUNNEL=y (which is bool and
> depends on IPv6, hence it is also modularized in this case), then
> IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) returns true, even though the
> seg6_* symbols are not available when linking vmlinux. If I'm correct,
> since net/core/filter.c is always built-in, all functions it uses must
> also be built-in.
> 
> I didn't find any other dependency from net/core/filter.c using a
> feature which can be modularized, hence the only solution I see here
> is to create a new bool CONFIG variable, e.g. CONFIG_IPV6_SEG6_BPF,
> which would require CONFIG_IPV6=y and CONFIG_IPV6_SEG6_LWTUNNEL=y. I
> could then replace my #if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL)
> conditions by #if IS_ENABLED(CONFIG_IPV6_SEG6_BPF) in
> net/core/filter.c.

Requiring CONFIG_IPV6=y for this feature would unfortunate.
I think the least ugliest solution would be to add seg6 functions
to ipv6_bpf_stub and call them indirectly if they are not
in critical path.
If it is the fast path then CONFIG_IPV6=y is the only option,
but don't expose the new CONFIG_IPV6_SEG6_BPF to the user.
Make it automatic y/n depending on CONFIG_IPV6=y or (n|m)


> Any comment on this ?
> 
> Thanks.
> 
> 2018-05-07 0:29 GMT+01:00 kbuild test robot <lkp@...el.com>:
> > Hi Mathieu,
> >
> > Thank you for the patch! Yet something to improve:
> >
> > [auto build test ERROR on bpf-next/master]
> >
> > url:    https://github.com/0day-ci/linux/commits/Mathieu-Xhonneux/ipv6-sr-introduce-seg6local-End-BPF-action/20180506-233046
> > base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
> > config: s390-allmodconfig (attached as .config)
> > compiler: s390x-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
> > reproduce:
> >         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
> >         chmod +x ~/bin/make.cross
> >         # save the attached .config to linux build tree
> >         make.cross ARCH=s390
> >
> > All errors (new ones prefixed by >>):
> >
> >    net/core/filter.o: In function `bpf_push_seg6_encap':
> >    filter.c:(.text+0xaf4c): undefined reference to `seg6_validate_srh'
> >    filter.c:(.text+0xaf8a): undefined reference to `seg6_do_srh_inline'
> >    filter.c:(.text+0xafc4): undefined reference to `seg6_do_srh_encap'
> >    filter.c:(.text+0xb016): undefined reference to `seg6_lookup_nexthop'
> >    net/core/filter.o: In function `bpf_lwt_seg6_store_bytes':
> >>> (.text+0xb106): undefined reference to `seg6_bpf_srh_states'
> >    net/core/filter.o: In function `bpf_lwt_seg6_action':
> >    (.text+0xb2b0): undefined reference to `seg6_bpf_srh_states'
> >>> (.text+0xb334): undefined reference to `seg6_validate_srh'
> >>> (.text+0xb394): undefined reference to `seg6_lookup_nexthop'
> >    (.text+0xb3c4): undefined reference to `seg6_lookup_nexthop'
> >    net/core/filter.o: In function `bpf_lwt_seg6_adjust_srh':
> >    (.text+0xb492): undefined reference to `seg6_bpf_srh_states'
> >
> > ---
> > 0-DAY kernel test infrastructure                Open Source Technology Center
> > https://lists.01.org/pipermail/kbuild-all                   Intel Corporation