lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 6 Oct 2020 18:34:50 -0700
From:   Maciej ┼╗enczykowski <maze@...gle.com>
To:     Jesper Dangaard Brouer <brouer@...hat.com>
Cc:     bpf <bpf@...r.kernel.org>, Linux NetDev <netdev@...r.kernel.org>,
        Daniel Borkmann <borkmann@...earbox.net>,
        Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Lorenz Bauer <lmb@...udflare.com>,
        Shaun Crampton <shaun@...era.io>,
        Lorenzo Bianconi <lorenzo@...nel.org>,
        Marek Majkowski <marek@...udflare.com>,
        John Fastabend <john.fastabend@...il.com>,
        Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH bpf-next V1 2/6] bpf: bpf_fib_lookup return MTU value as
 output when looked up

On Tue, Oct 6, 2020 at 9:03 AM Jesper Dangaard Brouer <brouer@...hat.com> wrote:
>
> The BPF-helpers for FIB lookup (bpf_xdp_fib_lookup and bpf_skb_fib_lookup)
> can perform MTU check and return BPF_FIB_LKUP_RET_FRAG_NEEDED.  The BPF-prog
> don't know the MTU value that caused this rejection.
>
> If the BPF-prog wants to implement PMTU (Path MTU Discovery) (rfc1191) it
> need to know this MTU value for the ICMP packet.
>
> Patch change lookup and result struct bpf_fib_lookup, to contain this MTU
> value as output via a union with 'tot_len' as this is the value used for
> the MTU lookup.
>
> Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
> ---
>  include/uapi/linux/bpf.h |   11 +++++++++--
>  net/core/filter.c        |   17 ++++++++++++-----
>  2 files changed, 21 insertions(+), 7 deletions(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index c446394135be..50ce65e37b16 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2216,6 +2216,9 @@ union bpf_attr {
>   *             * > 0 one of **BPF_FIB_LKUP_RET_** codes explaining why the
>   *               packet is not forwarded or needs assist from full stack
>   *
> + *             If lookup fails with BPF_FIB_LKUP_RET_FRAG_NEEDED, then the MTU
> + *             was exceeded and result params->mtu contains the MTU.
> + *
>   * long bpf_sock_hash_update(struct bpf_sock_ops *skops, struct bpf_map *map, void *key, u64 flags)
>   *     Description
>   *             Add an entry to, or update a sockhash *map* referencing sockets.
> @@ -4844,9 +4847,13 @@ struct bpf_fib_lookup {
>         __be16  sport;
>         __be16  dport;
>
> -       /* total length of packet from network header - used for MTU check */
> -       __u16   tot_len;
> +       union { /* used for MTU check */
> +               /* input to lookup */
> +               __u16   tot_len; /* total length of packet from network hdr */
>
> +               /* output: MTU value (if requested check_mtu) */
> +               __u16   mtu;
> +       };
>         /* input: L3 device index for lookup
>          * output: device index from FIB lookup
>          */
> diff --git a/net/core/filter.c b/net/core/filter.c
> index fed239e77bdc..d84723f347c0 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5185,13 +5185,14 @@ static const struct bpf_func_proto bpf_skb_get_xfrm_state_proto = {
>  #if IS_ENABLED(CONFIG_INET) || IS_ENABLED(CONFIG_IPV6)
>  static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params,
>                                   const struct neighbour *neigh,
> -                                 const struct net_device *dev)
> +                                 const struct net_device *dev, u32 mtu)
>  {
>         memcpy(params->dmac, neigh->ha, ETH_ALEN);
>         memcpy(params->smac, dev->dev_addr, ETH_ALEN);
>         params->h_vlan_TCI = 0;
>         params->h_vlan_proto = 0;
>         params->ifindex = dev->ifindex;
> +       params->mtu = mtu;
>
>         return 0;
>  }
> @@ -5275,8 +5276,10 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>
>         if (check_mtu) {
>                 mtu = ip_mtu_from_fib_result(&res, params->ipv4_dst);
> -               if (params->tot_len > mtu)
> +               if (params->tot_len > mtu) {
> +                       params->mtu = mtu; /* union with tot_len */
>                         return BPF_FIB_LKUP_RET_FRAG_NEEDED;
> +               }
>         }
>
>         nhc = res.nhc;
> @@ -5309,7 +5312,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>         if (!neigh)
>                 return BPF_FIB_LKUP_RET_NO_NEIGH;
>
> -       return bpf_fib_set_fwd_params(params, neigh, dev);
> +       return bpf_fib_set_fwd_params(params, neigh, dev, mtu);
>  }
>  #endif
>
> @@ -5401,8 +5404,10 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>
>         if (check_mtu) {
>                 mtu = ipv6_stub->ip6_mtu_from_fib6(&res, dst, src);
> -               if (params->tot_len > mtu)
> +               if (params->tot_len > mtu) {
> +                       params->mtu = mtu; /* union with tot_len */
>                         return BPF_FIB_LKUP_RET_FRAG_NEEDED;
> +               }
>         }
>
>         if (res.nh->fib_nh_lws)
> @@ -5421,7 +5426,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
>         if (!neigh)
>                 return BPF_FIB_LKUP_RET_NO_NEIGH;
>
> -       return bpf_fib_set_fwd_params(params, neigh, dev);
> +       return bpf_fib_set_fwd_params(params, neigh, dev, mtu);
>  }
>  #endif
>
> @@ -5490,6 +5495,8 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
>                 dev = dev_get_by_index_rcu(net, params->ifindex);
>                 if (!is_skb_forwardable(dev, skb))
>                         rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
> +
> +               params->mtu = dev->mtu; /* union with tot_len */
>         }
>
>         return rc;
>
>

It would be beneficial to be able to fetch the route advmss, initcwnd,
etc as well...
But I take it the struct can't be extended?

Powered by blists - more mailing lists