netdev - [PATCH iproute2-next] flower: add orig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210830080849.18695-1-boris.sukholitko@broadcom.com>
Date:   Mon, 30 Aug 2021 11:08:49 +0300
From:   Boris Sukholitko <boris.sukholitko@...adcom.com>
To:     netdev@...r.kernel.org
Cc:     Ilya Lifshits <ilya.lifshits@...adcom.com>,
        Boris Sukholitko <boris.sukholitko@...adcom.com>
Subject: [PATCH iproute2-next] flower: add orig_ethtype key

The following flower filter fails to match packets:

tc filter add dev eth0 ingress protocol 0x8864 flower \
        action simple sdata hi64

The following is explanation of the issue on the kernel side.

The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
being dissected by __skb_flow_dissect and it's internal protocol is
being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
tunnel is transparent to the callers of __skb_flow_dissect.

OTOH, in the filters above, cls_flower configures its key->basic.n_proto
to the ETH_P_PPP_SES value configured by the user. Matching on this key
fails because of __skb_flow_dissect "transparency" mentioned above.

Therefore there is no way currently to match on such packets using
flower.

To fix the issue add new orig_ethtype key to the flower along with the
necessary changes to the flow dissector etc.

To filter the ETH_P_PPP_SES packets the command becomes:

tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
        action simple sdata hi64

Corresponding kernel patch was sent separately.

Signed-off-by: Boris Sukholitko <boris.sukholitko@...adcom.com>
---
 include/uapi/linux/pkt_cls.h |  1 +
 tc/f_flower.c                | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 025c40fe..238dee49 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -583,6 +583,7 @@ enum {
 	TCA_FLOWER_KEY_HASH,		/* u32 */
 	TCA_FLOWER_KEY_HASH_MASK,	/* u32 */
 
+	TCA_FLOWER_KEY_ORIG_ETH_TYPE,	/* be16 */
 	__TCA_FLOWER_MAX,
 };
 
diff --git a/tc/f_flower.c b/tc/f_flower.c
index c5af0276..935d0cbd 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -1431,6 +1431,13 @@ static int flower_parse_opt(struct filter_util *qu, char *handle,
 			if (check_ifname(*argv))
 				invarg("\"indev\" not a valid ifname", *argv);
 			addattrstrz(n, MAX_MSG, TCA_FLOWER_INDEV, *argv);
+		} else if (matches(*argv, "orig_ethtype") == 0) {
+			__be16 orig_ethtype;
+
+			NEXT_ARG();
+			if (ll_proto_a2n(&orig_ethtype, *argv))
+				invarg("invalid orig_ethtype", *argv);
+			addattr16(n, MAX_MSG, TCA_FLOWER_KEY_ORIG_ETH_TYPE, orig_ethtype);
 		} else if (matches(*argv, "vlan_id") == 0) {
 			__u16 vid;
 
@@ -2582,6 +2589,16 @@ static int flower_print_opt(struct filter_util *qu, FILE *f,
 			     rta_getattr_str(attr));
 	}
 
+	if (tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE]) {
+		SPRINT_BUF(buf);
+		struct rtattr *attr = tb[TCA_FLOWER_KEY_ORIG_ETH_TYPE];
+
+		print_nl();
+		print_string(PRINT_ANY, "orig_ethtype", "  orig_ethtype %s",
+			     ll_proto_n2a(rta_getattr_u16(attr),
+			     buf, sizeof(buf)));
+	}
+
 	open_json_object("keys");
 
 	if (tb[TCA_FLOWER_KEY_VLAN_ID]) {
-- 
2.29.2


Download attachment "smime.p7s" of type "application/pkcs7-signature" (4221 bytes)