| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAPhsuW4A_z+LxUZ8zDojNWaAWHTNi9w1nA1Bj2NBNzY+DJtyNQ@mail.gmail.com>
Date: Wed, 24 Jul 2019 16:29:42 -0700
From: Song Liu <liu.song.a23@...il.com>
To: Stanislav Fomichev <sdf@...gle.com>
Cc: Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
"David S . Miller" <davem@...emloft.net>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Willem de Bruijn <willemb@...gle.com>,
Petar Penkov <ppenkov@...gle.com>
Subject: Re: [PATCH bpf-next 7/7] selftests/bpf: support FLOW_DISSECTOR_F_STOP_AT_ENCAP
On Wed, Jul 24, 2019 at 10:11 AM Stanislav Fomichev <sdf@...gle.com> wrote:
>
> Exit as soon as we found that packet is encapped when
> FLOW_DISSECTOR_F_STOP_AT_ENCAP is passed.
> Add appropriate selftest cases.
>
> Cc: Willem de Bruijn <willemb@...gle.com>
> Cc: Petar Penkov <ppenkov@...gle.com>
> Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
Acked-by: Song Liu <songliubraving@...com>
> ---
> .../selftests/bpf/prog_tests/flow_dissector.c | 60 +++++++++++++++++++
> tools/testing/selftests/bpf/progs/bpf_flow.c | 8 +++
> 2 files changed, 68 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
> index 1ea921c4cdc0..e382264fbc40 100644
> --- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
> +++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
> @@ -41,6 +41,13 @@ struct ipv4_pkt {
> struct tcphdr tcp;
> } __packed;
>
> +struct ipip_pkt {
> + struct ethhdr eth;
> + struct iphdr iph;
> + struct iphdr iph_inner;
> + struct tcphdr tcp;
> +} __packed;
> +
> struct svlan_ipv4_pkt {
> struct ethhdr eth;
> __u16 vlan_tci;
> @@ -82,6 +89,7 @@ struct test {
> union {
> struct ipv4_pkt ipv4;
> struct svlan_ipv4_pkt svlan_ipv4;
> + struct ipip_pkt ipip;
> struct ipv6_pkt ipv6;
> struct ipv6_frag_pkt ipv6_frag;
> struct dvlan_ipv6_pkt dvlan_ipv6;
> @@ -303,6 +311,58 @@ struct test tests[] = {
> },
> .flags = FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL,
> },
> + {
> + .name = "ipip-encap",
> + .pkt.ipip = {
> + .eth.h_proto = __bpf_constant_htons(ETH_P_IP),
> + .iph.ihl = 5,
> + .iph.protocol = IPPROTO_IPIP,
> + .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
> + .iph_inner.ihl = 5,
> + .iph_inner.protocol = IPPROTO_TCP,
> + .iph_inner.tot_len = __bpf_constant_htons(MAGIC_BYTES),
> + .tcp.doff = 5,
> + .tcp.source = 80,
> + .tcp.dest = 8080,
> + },
> + .keys = {
> + .nhoff = 0,
> + .nhoff = ETH_HLEN,
> + .thoff = ETH_HLEN + sizeof(struct iphdr) +
> + sizeof(struct iphdr),
> + .addr_proto = ETH_P_IP,
> + .ip_proto = IPPROTO_TCP,
> + .n_proto = __bpf_constant_htons(ETH_P_IP),
> + .is_encap = true,
> + .sport = 80,
> + .dport = 8080,
> + },
> + },
> + {
> + .name = "ipip-no-encap",
> + .pkt.ipip = {
> + .eth.h_proto = __bpf_constant_htons(ETH_P_IP),
> + .iph.ihl = 5,
> + .iph.protocol = IPPROTO_IPIP,
> + .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
> + .iph_inner.ihl = 5,
> + .iph_inner.protocol = IPPROTO_TCP,
> + .iph_inner.tot_len = __bpf_constant_htons(MAGIC_BYTES),
> + .tcp.doff = 5,
> + .tcp.source = 80,
> + .tcp.dest = 8080,
> + },
> + .keys = {
> + .flags = FLOW_DISSECTOR_F_STOP_AT_ENCAP,
> + .nhoff = ETH_HLEN,
> + .thoff = ETH_HLEN + sizeof(struct iphdr),
> + .addr_proto = ETH_P_IP,
> + .ip_proto = IPPROTO_IPIP,
> + .n_proto = __bpf_constant_htons(ETH_P_IP),
> + .is_encap = true,
> + },
> + .flags = FLOW_DISSECTOR_F_STOP_AT_ENCAP,
> + },
> };
>
> static int create_tap(const char *ifname)
> diff --git a/tools/testing/selftests/bpf/progs/bpf_flow.c b/tools/testing/selftests/bpf/progs/bpf_flow.c
> index 7d73b7bfe609..b6236cdf8564 100644
> --- a/tools/testing/selftests/bpf/progs/bpf_flow.c
> +++ b/tools/testing/selftests/bpf/progs/bpf_flow.c
> @@ -167,9 +167,15 @@ static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
> return export_flow_keys(keys, BPF_OK);
> case IPPROTO_IPIP:
> keys->is_encap = true;
> + if (keys->flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
> + return export_flow_keys(keys, BPF_OK);
> +
> return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
> case IPPROTO_IPV6:
> keys->is_encap = true;
> + if (keys->flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
> + return export_flow_keys(keys, BPF_OK);
> +
> return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
> case IPPROTO_GRE:
> gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
> @@ -189,6 +195,8 @@ static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
> keys->thoff += 4; /* Step over sequence number */
>
> keys->is_encap = true;
> + if (keys->flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
> + return export_flow_keys(keys, BPF_OK);
>
> if (gre->proto == bpf_htons(ETH_P_TEB)) {
> eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
> --
> 2.22.0.657.g960e92d24f-goog
>
Powered by blists - more mailing lists