netdev - Re: [PATCH net-next 1/1] net/sched: Introduce skb hash classifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200812210721.GE3398@localhost.localdomain>
Date:   Wed, 12 Aug 2020 18:07:21 -0300
From:   Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     Jamal Hadi Salim <jhs@...atatu.com>,
        David Miller <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Jiri Pirko <jiri@...nulli.us>,
        Ariel Levkovich <lariel@...lanox.com>
Subject: Re: [PATCH net-next 1/1] net/sched: Introduce skb hash classifier

On Tue, Aug 11, 2020 at 04:25:43PM -0700, Cong Wang wrote:
> On Sun, Aug 9, 2020 at 4:41 PM Jamal Hadi Salim <jhs@...atatu.com> wrote:
> >
> > Interesting idea. Note: my experience is that typical setup is
> > to have only one of those (from offload perspective). Ariel,
> > are your use cases requiring say both fields?
> >
> >  From policy perspective, i think above will get more complex
> > mostly because you have to deal with either mark or hash
> > being optional. It also opens doors for more complex matching
> > requirements. Example "match mark X AND hash Y" and
> > "match mark X OR hash Y".
> > The new classifier will have to deal with that semantic.
> >
> > With fw and hash being the complex/optional semantics are easy:
> >
> > "match mark X AND hash Y":
> > $TC filter add dev $DEV1 parent ffff: protocol ip prio 3 handle X
> > skbhash flowid 1:12 action continue
> > $TC filter add dev $DEV1 parent ffff: protocol ip prio 4 handle Y fw
> > flowid 1:12 action ok
> >
> > "match mark X OR hash Y":
> > $TC filter add dev $DEV1 parent ffff: protocol ip prio 3 handle X
> > skbhash flowid 1:12 action ok
> > $TC filter add dev $DEV1 parent ffff: protocol ip prio 4 handle Y fw
> > flowid 1:12 action ok
> 
> Not sure if I get you correctly, but with a combined implementation
> you can do above too, right? Something like:
> 
> (AND case)
> $TC filter add dev $DEV1 parent ffff: protocol ip prio 3 handle 1
> skb hash Y mark X flowid 1:12 action ok

I probably missed something, but this kind of matching is pretty much
what flower does today. Is it just to avoid key extraction/flow
dissector or did I miss something?  I know there was a thread on how
to match on this hash before, but other than what I just said, I can't
recall other arguments.