lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 4 Jun 2021 10:55:28 +0800 From: Jason Wang <jasowang@...hat.com> To: Tanner Love <tannerlove.kernel@...il.com>, netdev@...r.kernel.org Cc: davem@...emloft.net, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Eric Dumazet <edumazet@...gle.com>, Willem de Bruijn <willemb@...gle.com>, Petar Penkov <ppenkov@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Tanner Love <tannerlove@...gle.com>, "Michael S. Tsirkin" <mst@...hat.com> Subject: Re: [PATCH net-next v3 0/3] virtio_net: add optional flow dissection in virtio_net_hdr_to_skb 在 2021/6/2 上午6:18, Tanner Love 写道: > From: Tanner Love <tannerlove@...gle.com> > > First patch extends the flow dissector BPF program type to accept > virtio-net header members. > > Second patch uses this feature to add optional flow dissection in > virtio_net_hdr_to_skb(). This allows admins to define permitted > packets more strictly, for example dropping deprecated UDP_UFO > packets. > > Third patch extends kselftest to cover this feature. I wonder why virtio maintainers is not copied in this series. Several questions: 1) having bpf core to know about virito-net header seems like a layer violation, it doesn't scale as we may add new fields, actually there's already fields that is not implemented in the spec but not Linux right now. 2) virtio_net_hdr_to_skb() is not the single entry point, packet could go via XDP 3) I wonder whether we can simply use XDP to solve this issue (metadata probably but I don't have a deep thought) 4) If I understand the code correctly, it should deal with all dodgy packets instead of just for virtio Thanks > > Tanner Love (3): > net: flow_dissector: extend bpf flow dissector support with vnet hdr > virtio_net: add optional flow dissection in virtio_net_hdr_to_skb > selftests/net: amend bpf flow dissector prog to do vnet hdr validation > > drivers/net/bonding/bond_main.c | 2 +- > include/linux/skbuff.h | 26 ++- > include/linux/virtio_net.h | 25 ++- > include/net/flow_dissector.h | 6 + > include/uapi/linux/bpf.h | 6 + > net/core/filter.c | 55 +++++ > net/core/flow_dissector.c | 27 ++- > net/core/sysctl_net_core.c | 9 + > tools/include/uapi/linux/bpf.h | 6 + > tools/testing/selftests/bpf/progs/bpf_flow.c | 188 +++++++++++++----- > .../selftests/bpf/test_flow_dissector.c | 181 +++++++++++++++-- > .../selftests/bpf/test_flow_dissector.sh | 19 ++ > 12 files changed, 470 insertions(+), 80 deletions(-) >
Powered by blists - more mailing lists