netdev - Re: [PATCH net-next] net/sched: cls_flower: Add orig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Aug 2021 21:48:38 -0400
From:   Jamal Hadi Salim <jhs@...atatu.com>
To:     Boris Sukholitko <boris.sukholitko@...adcom.com>,
        netdev@...r.kernel.org, Jiri Pirko <jiri@...nulli.us>,
        Cong Wang <xiyou.wangcong@...il.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Vladimir Oltean <olteanv@...il.com>,
        Vadym Kochan <vadym.kochan@...ision.eu>,
        Ilya Lifshits <ilya.lifshits@...adcom.com>,
        tom Herbert <tom@...anda.io>,
        Felipe Magno de Almeida <felipe@...ertise.dev>,
        Pedro Tammela <pctammela@...atatu.com>
Subject: Re: [PATCH net-next] net/sched: cls_flower: Add orig_ethtype

On 2021-08-30 4:08 a.m., Boris Sukholitko wrote:
> The following flower filter fails to match packets:
> 
> tc filter add dev eth0 ingress protocol 0x8864 flower \
>      action simple sdata hi64
> 
> The protocol 0x8864 (ETH_P_PPP_SES) is a tunnel protocol. As such, it is
> being dissected by __skb_flow_dissect and it's internal protocol is
> being set as key->basic.n_proto. IOW, the existence of ETH_P_PPP_SES
> tunnel is transparent to the callers of __skb_flow_dissect.
> 
> OTOH, in the filters above, cls_flower configures its key->basic.n_proto
> to the ETH_P_PPP_SES value configured by the user. Matching on this key
> fails because of __skb_flow_dissect "transparency" mentioned above.
> 
> Therefore there is no way currently to match on such packets using
> flower.
> 
> To fix the issue add new orig_ethtype key to the flower along with the
> necessary changes to the flow dissector etc.
> 
> To filter the ETH_P_PPP_SES packets the command becomes:
> 
> tc filter add dev eth0 ingress flower orig_ethtype 0x8864 \
>      action simple sdata hi64

Where's "protocol" on the above command line is. Probably a typo?

The main culprit is clearly the flow dissector parsing. I am not sure
if in general flowdisc to deal with deeper hierarchies/tunnels
without constantly adding a lot more hacks. Imagine if you had an
ethernet packet with double vlan tags and encapsulating a pppoe packet
(i.e 3 or more layers of ethernet) - that would be a nightmare.
IMO, your approach is adding yet another bandaid.

Would it make sense for the setting of the
skb_key.basic.n_proto  to be from tp->protocol for
your specific case in classify().

Which means your original setup:
  tc filter add dev eth0 ingress protocol 0x8864 flower \
      action simple sdata hi64

should continue to work if i am not mistaken. Vlans would
continue to be a speacial case.

I dont know what that would break though...

cheers,
jamal