netdev - Re: [PATCH net-next v3 0/3] virtio_net: add optional flow dissection in virtio_net_hdr_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eef275f7-38c5-6967-7678-57dd5d59cf76@redhat.com>
Date:   Fri, 4 Jun 2021 10:55:28 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Tanner Love <tannerlove.kernel@...il.com>, netdev@...r.kernel.org
Cc:     davem@...emloft.net, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Willem de Bruijn <willemb@...gle.com>,
        Petar Penkov <ppenkov@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Tanner Love <tannerlove@...gle.com>,
        "Michael S. Tsirkin" <mst@...hat.com>
Subject: Re: [PATCH net-next v3 0/3] virtio_net: add optional flow dissection
 in virtio_net_hdr_to_skb


在 2021/6/2 上午6:18, Tanner Love 写道:
> From: Tanner Love <tannerlove@...gle.com>
>
> First patch extends the flow dissector BPF program type to accept
> virtio-net header members.
>
> Second patch uses this feature to add optional flow dissection in
> virtio_net_hdr_to_skb(). This allows admins to define permitted
> packets more strictly, for example dropping deprecated UDP_UFO
> packets.
>
> Third patch extends kselftest to cover this feature.


I wonder why virtio maintainers is not copied in this series.

Several questions:

1) having bpf core to know about virito-net header seems like a layer 
violation, it doesn't scale as we may add new fields, actually there's 
already fields that is not implemented in the spec but not Linux right now.
2) virtio_net_hdr_to_skb() is not the single entry point, packet could 
go via XDP
3) I wonder whether we can simply use XDP to solve this issue (metadata 
probably but I don't have a deep thought)
4) If I understand the code correctly, it should deal with all dodgy 
packets instead of just for virtio

Thanks


>
> Tanner Love (3):
>    net: flow_dissector: extend bpf flow dissector support with vnet hdr
>    virtio_net: add optional flow dissection in virtio_net_hdr_to_skb
>    selftests/net: amend bpf flow dissector prog to do vnet hdr validation
>
>   drivers/net/bonding/bond_main.c               |   2 +-
>   include/linux/skbuff.h                        |  26 ++-
>   include/linux/virtio_net.h                    |  25 ++-
>   include/net/flow_dissector.h                  |   6 +
>   include/uapi/linux/bpf.h                      |   6 +
>   net/core/filter.c                             |  55 +++++
>   net/core/flow_dissector.c                     |  27 ++-
>   net/core/sysctl_net_core.c                    |   9 +
>   tools/include/uapi/linux/bpf.h                |   6 +
>   tools/testing/selftests/bpf/progs/bpf_flow.c  | 188 +++++++++++++-----
>   .../selftests/bpf/test_flow_dissector.c       | 181 +++++++++++++++--
>   .../selftests/bpf/test_flow_dissector.sh      |  19 ++
>   12 files changed, 470 insertions(+), 80 deletions(-)
>