| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20210830080800.18591-1-boris.sukholitko@broadcom.com>
Date: Mon, 30 Aug 2021 11:08:00 +0300
From: Boris Sukholitko <boris.sukholitko@...adcom.com>
To: netdev@...r.kernel.org, Jamal Hadi Salim <jhs@...atatu.com>,
Jiri Pirko <jiri@...nulli.us>,
Cong Wang <xiyou.wangcong@...il.com>
Cc: "David S . Miller" <davem@...emloft.net>,
Jakub Kicinski <kuba@...nel.org>,
Vladimir Oltean <olteanv@...il.com>,
Vadym Kochan <vadym.kochan@...ision.eu>,
Ilya Lifshits <ilya.lifshits@...adcom.com>,
Boris Sukholitko <boris.sukholitko@...adcom.com>
Subject: [PATCH net-next] net/sched: cls_flower: Add orig_ethtype
The following flower filter fails to match packets:
tc filter add dev eth0 ingress protocol 0x8864 flower \
action simple sdata hi64
The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.
OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.
Therefore there is no way currently to match on such packets using
flower.
To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.
To filter the ETH_P_PPP_SES packets the command becomes:
tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
action simple sdata hi64
Corresponding iproute2 patch follows.
Signed-off-by: Boris Sukholitko <boris.sukholitko@...adcom.com>
---
include/net/flow_dissector.h | 9 +++++++++
include/uapi/linux/pkt_cls.h | 1 +
net/core/flow_dissector.c | 12 ++++++++++++
net/sched/cls_flower.c | 15 +++++++++++++++
4 files changed, 37 insertions(+)
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index ffd386ea0dbb..083245a2d408 100644
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -251,6 +251,14 @@ struct flow_dissector_key_hash {
u32 hash;
};
+/**
+ * struct flow_dissector_key_orig_ethtype:
+ * @orig_ethtype: eth type as it appears in the packet
+ */
+struct flow_dissector_key_orig_ethtype {
+ __be16 orig_ethtype;
+};
+
enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */
FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */
@@ -280,6 +288,7 @@ enum flow_dissector_key_id {
FLOW_DISSECTOR_KEY_META, /* struct flow_dissector_key_meta */
FLOW_DISSECTOR_KEY_CT, /* struct flow_dissector_key_ct */
FLOW_DISSECTOR_KEY_HASH, /* struct flow_dissector_key_hash */
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE, /* struct flow_dissector_key_orig_ethtype */
FLOW_DISSECTOR_KEY_MAX,
};
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 025c40fef93d..238dee49f450 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -583,6 +583,7 @@ enum {
TCA_FLOWER_KEY_HASH, /* u32 */
TCA_FLOWER_KEY_HASH_MASK, /* u32 */
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE, /* be16 */
__TCA_FLOWER_MAX,
};
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 4b2415d34873..23051e0d02fd 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -924,6 +924,7 @@ bool __skb_flow_dissect(const struct net *net,
struct flow_dissector_key_vlan *key_vlan;
enum flow_dissect_ret fdret;
enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX;
+ __be16 orig_proto = proto;
bool mpls_el = false;
int mpls_lse = 0;
int num_hdrs = 0;
@@ -934,6 +935,7 @@ bool __skb_flow_dissect(const struct net *net,
data = skb->data;
proto = skb_vlan_tag_present(skb) ?
skb->vlan_proto : skb->protocol;
+ orig_proto = proto;
nhoff = skb_network_offset(skb);
hlen = skb_headlen(skb);
#if IS_ENABLED(CONFIG_NET_DSA)
@@ -1032,6 +1034,16 @@ bool __skb_flow_dissect(const struct net *net,
memcpy(key_eth_addrs, ð->h_dest, sizeof(*key_eth_addrs));
}
+ if (dissector_uses_key(flow_dissector,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE)) {
+ struct flow_dissector_key_orig_ethtype *orig_ethtype;
+
+ orig_ethtype = skb_flow_dissector_target(flow_dissector,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE,
+ target_container);
+ orig_ethtype->orig_ethtype = orig_proto;
+ }
+
proto_again:
fdret = FLOW_DISSECT_RET_CONTINUE;
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d7869a984881..bf6e88819f7d 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -70,6 +70,7 @@ struct fl_flow_key {
} tp_range;
struct flow_dissector_key_ct ct;
struct flow_dissector_key_hash hash;
+ struct flow_dissector_key_orig_ethtype orig_ethtype;
} __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */
struct fl_flow_mask_range {
@@ -710,6 +711,7 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = {
[TCA_FLOWER_FLAGS] = { .type = NLA_U32 },
[TCA_FLOWER_KEY_HASH] = { .type = NLA_U32 },
[TCA_FLOWER_KEY_HASH_MASK] = { .type = NLA_U32 },
+ [TCA_FLOWER_KEY_ORIG_ETH_TYPE] = { .type = NLA_U16 },
};
@@ -1696,6 +1698,11 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
&mask->hash.hash, TCA_FLOWER_KEY_HASH_MASK,
sizeof(key->hash.hash));
+ fl_set_key_val(tb, &key->orig_ethtype.orig_ethtype,
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE,
+ &mask->orig_ethtype.orig_ethtype, TCA_FLOWER_UNSPEC,
+ sizeof(key->orig_ethtype.orig_ethtype));
+
if (tb[TCA_FLOWER_KEY_ENC_OPTS]) {
ret = fl_set_enc_opt(tb, key, mask, extack);
if (ret)
@@ -1812,6 +1819,8 @@ static void fl_init_dissector(struct flow_dissector *dissector,
FLOW_DISSECTOR_KEY_CT, ct);
FL_KEY_SET_IF_MASKED(mask, keys, cnt,
FLOW_DISSECTOR_KEY_HASH, hash);
+ FL_KEY_SET_IF_MASKED(mask, keys, cnt,
+ FLOW_DISSECTOR_KEY_ORIG_ETH_TYPE, orig_ethtype);
skb_flow_dissector_init(dissector, keys, cnt);
}
@@ -3037,6 +3046,12 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net,
sizeof(key->hash.hash)))
goto nla_put_failure;
+ if (fl_dump_key_val(skb, &key->orig_ethtype.orig_ethtype,
+ TCA_FLOWER_KEY_ORIG_ETH_TYPE,
+ &mask->orig_ethtype.orig_ethtype, TCA_FLOWER_UNSPEC,
+ sizeof(key->orig_ethtype.orig_ethtype)))
+ goto nla_put_failure;
+
return 0;
nla_put_failure:
--
2.29.2
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4221 bytes)
Powered by blists - more mailing lists