netdev - [PATCH net-next 0/4] mlxsw: Add one-armed router support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181204081317.26641-1-idosch@mellanox.com>
Date:   Tue, 4 Dec 2018 08:15:09 +0000
From:   Ido Schimmel <idosch@...lanox.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        Jiri Pirko <jiri@...lanox.com>,
        "dsahern@...il.com" <dsahern@...il.com>,
        Alexander Petrovskiy <alexpe@...lanox.com>,
        "az@...tor.net" <az@...tor.net>, mlxsw <mlxsw@...lanox.com>,
        Ido Schimmel <idosch@...lanox.com>
Subject: [PATCH net-next 0/4] mlxsw: Add one-armed router support

Up until now, when a packet was routed by the ASIC through the same
router interface (RIF) from which it ingressed from, the ASIC passed the
sole copy of the packet to the kernel. This allowed the kernel to route
the packet and also potentially generate an ICMP redirect.

There are scenarios (e.g., "one-armed router") where packets are
intentionally routed this way and are therefore not deemed as
exceptions. In such scenarios the current method of trapping packets to
the CPU is problematic, as it results in major packet loss.

This patchset solves the problem by having the ASIC forward the packet,
but also send a copy to the CPU, which gives the kernel the opportunity
to generate required exceptions.

To prevent the kernel from forwarding such packets again, the driver
marks them with 'offload_l3_fwd_mark', which causes the kernel to
consume them in ip{,6}_forward_finish().

Patch #1 renames 'offload_mr_fwd_mark' to 'offload_l3_fwd_mark'. When
set, the field indicates that a packet was already forwarded in L3
(unicast / multicast) by a capable device.

Patch #2 teaches the kernel to consume unicast packets that have
'offload_l3_fwd_mark' set.

Patch #3 changes mlxsw to mirror loopbacked (iRIF == eRIF) packets,
instead of trapping them.

Patch #4 adds a test case for above mentioned scenario.

Ido Schimmel (4):
  skbuff: Rename 'offload_mr_fwd_mark' to 'offload_l3_fwd_mark'
  net: Do not route unicast IP packets twice
  mlxsw: spectrum: Mirror loopbacked packets instead of trapping them
  selftests: mlxsw: Add one-armed router test

 drivers/net/ethernet/mellanox/mlxsw/reg.h     |   1 +
 .../net/ethernet/mellanox/mlxsw/spectrum.c    |  14 +-
 include/linux/skbuff.h                        |   4 +-
 net/core/skbuff.c                             |   2 +-
 net/ipv4/ip_forward.c                         |   7 +
 net/ipv4/ipmr.c                               |   2 +-
 net/ipv6/ip6_output.c                         |   7 +
 .../drivers/net/mlxsw/one_armed_router.sh     | 259 ++++++++++++++++++
 8 files changed, 287 insertions(+), 9 deletions(-)
 create mode 100755 tools/testing/selftests/drivers/net/mlxsw/one_armed_router.sh

-- 
2.19.1