netdev - [RFC bpf-next v3 0/8] net: flow_dissector: trigger BPF hook when called from eth_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190322195903.162516-1-sdf@google.com>
Date:   Fri, 22 Mar 2019 12:58:55 -0700
From:   Stanislav Fomichev <sdf@...gle.com>
To:     netdev@...r.kernel.org, bpf@...r.kernel.org
Cc:     davem@...emloft.net, ast@...nel.org, daniel@...earbox.net,
        simon.horman@...ronome.com, willemb@...gle.com,
        peterpenkov96@...il.com, Stanislav Fomichev <sdf@...gle.com>
Subject: [RFC bpf-next v3 0/8] net: flow_dissector: trigger BPF hook when
 called from eth_get_headlen

Currently, when eth_get_headlen calls flow dissector, it doesn't pass any
skb. Because we use passed skb to lookup associated networking namespace
to find whether we have a BPF program attached or not, we always use
C-based flow dissector in this case.

The goal of this patch series is to add new networking namespace argument
to the eth_get_headlen and make BPF flow dissector programs be able to
work in the skb-less case.

The series goes like this:
1. restrict access to a limited set of __sk_buff fields from flow
   dissector programs; in eth_get_headlen context, they don't
   make sense (for skb-context, they are also not relevant for
   flow dissector)
2. switch kernel context to new xdp_buff-like structure (struct
   bpf_flow_dissector) for flow dissector program
3. minor fix for nhoff clamping; doesn't affect anything besides tests
4. convert flow dissector BPF_PROG_TEST_RUN to skb-less mode to show that
   it works
5. add new optional network namespace argument to __skb_flow_dissect and
   plumb through the callers
6. handle __skb_flow_dissect with skb == NULL
7. add new net namespace argument to eth_get_headlen and adjust all users
8. add selftest that makes sure bpf_skb_load_bytes is prohibited in
   skb-less context

v3:
* new kernel xdp_buff-like context per Alexey suggestion
* drop skb_net helper
* properly clamp flow_keys->nhoff

v2:
* moved temporary skb from stack into percpu (avoids memset of ~200 bytes
  per packet)
* tightened down access to __sk_buff fields from flow dissector programs to
  avoid touching shinfo (whitelist only relevant fields)
* addressed suggestions from Willem

Stanislav Fomichev (8):
  flow_dissector: allow access only to a subset of __sk_buff fields
  flow_dissector: switch kernel context to struct bpf_flow_dissector
  flow_dissector: fix clamping of BPF flow_keys for non-zero nhoff
  bpf: when doing BPF_PROG_TEST_RUN for flow dissector use no-skb mode
  net: plumb network namespace into __skb_flow_dissect
  flow_dissector: handle no-skb use case
  net: pass net argument to the eth_get_headlen
  selftests/bpf: add flow dissector bpf_skb_load_bytes helper test

 drivers/net/ethernet/broadcom/bnxt/bnxt.c     |   2 +-
 drivers/net/ethernet/hisilicon/hns/hns_enet.c |   3 +-
 .../net/ethernet/hisilicon/hns3/hns3_enet.c   |   3 +-
 drivers/net/ethernet/intel/fm10k/fm10k_main.c |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c   |   3 +-
 drivers/net/ethernet/intel/iavf/iavf_txrx.c   |   3 +-
 drivers/net/ethernet/intel/ice/ice_txrx.c     |   2 +-
 drivers/net/ethernet/intel/igb/igb_main.c     |   3 +-
 drivers/net/ethernet/intel/igc/igc_main.c     |   3 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |   2 +-
 .../net/ethernet/intel/ixgbevf/ixgbevf_main.c |   3 +-
 .../net/ethernet/mellanox/mlx5/core/en_tx.c   |   3 +-
 drivers/net/tun.c                             |   3 +-
 include/linux/etherdevice.h                   |   2 +-
 include/linux/skbuff.h                        |  23 ++-
 include/net/flow_dissector.h                  |  11 ++
 include/net/sch_generic.h                     |  11 +-
 net/bpf/test_run.c                            |  51 ++----
 net/core/filter.c                             | 151 +++++++++++++-----
 net/core/flow_dissector.c                     |  85 +++++-----
 net/ethernet/eth.c                            |   8 +-
 .../prog_tests/flow_dissector_load_bytes.c    |  48 ++++++
 22 files changed, 280 insertions(+), 145 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/flow_dissector_load_bytes.c

-- 
2.21.0.392.gf8f6787159e-goog