netdev - Re: [PATCH RFC v2] net: xdp: allow for layer 3 packets in generic skb handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Apr 2020 22:08:58 +0200
From:   Toke Høiland-Jørgensen <toke@...hat.com>
To:     "Jason A. Donenfeld" <Jason@...c4.com>,
        David Ahern <dsahern@...il.com>
Cc:     Netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH RFC v2] net: xdp: allow for layer 3 packets in generic skb handler

"Jason A. Donenfeld" <Jason@...c4.com> writes:

> On Mon, Apr 27, 2020 at 8:45 AM David Ahern <dsahern@...il.com> wrote:
>>
>> On 4/27/20 4:22 AM, Jason A. Donenfeld wrote:
>> > @@ -4544,6 +4544,13 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
>> >        * header.
>> >        */
>> >       mac_len = skb->data - skb_mac_header(skb);
>> > +     if (!mac_len) {
>> > +             add_eth_hdr = true;
>> > +             mac_len = sizeof(struct ethhdr);
>> > +             *((struct ethhdr *)skb_push(skb, mac_len)) = (struct ethhdr) {
>> > +                     .h_proto = skb->protocol
>> > +             };
>>
>> please use a temp variable and explicit setting of the fields; that is
>> not pleasant to read and can not be more performant than a more direct
>>
>>                 eth_zero_addr(eth->h_source);
>>                 eth_zero_addr(eth->h_dest);
>>                 eth->h_proto = skb->protocol;
>
> Ack, will change for the non-RFC v3 patch. I need to actually figure
> out how to test this thing first though...

You could try the xdp-filter application in this repo:

https://github.com/xdp-project/xdp-tools

(make sure you use --recurse-submodules when you clone it)

That will allow you to install simple IP- and port-based filters; should
be enough to check that XDP programs will correctly match the packet
contents, I think?

-Toke