netdev - RE: [PATCH] Bpf Helper Function BPF_FUNC_skb_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Dec 2021 19:16:41 +0000
From:   "Tyler Wear (QUIC)" <quic_twear@...cinc.com>
To:     Martin KaFai Lau <kafai@...com>,
        "Tyler Wear (QUIC)" <quic_twear@...cinc.com>
CC:     Yonghong Song <yhs@...com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "maze@...gle.com" <maze@...gle.com>
Subject: RE: [PATCH] Bpf Helper Function BPF_FUNC_skb_change_dsfield

> On Mon, Dec 20, 2021 at 07:18:42PM -0800, Yonghong Song wrote:
> >
> >
> > On 12/20/21 12:40 PM, Tyler Wear wrote:
> > > New bpf helper function BPF_FUNC_skb_change_dsfield "int 
> > > bpf_skb_change_dsfield(struct sk_buff *skb, u8 mask, u8 value)".
> > > BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog which currently can be 
> > > attached to the ingress and egress path. The helper is needed 
> > > because this type of bpf_prog cannot modify the skb directly.
> > >
> > > Used by a bpf_prog to specify DS field values on egress or ingress.
> >
> > Maybe you can expand a little bit here for your use case?
> > I know DS field might help but a description of your actual use case 
> > will make adding this helper more compelling.
> +1.  More details on the use case is needed.
> Also, having an individual helper for each particular header field is too specific.
>
> For egress, there is bpf_setsockopt() for IP_TOS and IPV6_TCLASS and it can be called in other cgroup hooks. e.g.
> BPF_PROG_TYPE_SOCK_OPS during tcp ESTABLISHED event.
> There is an example in tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c.
> Is it enough for egress?

Using bpf_setsockopt() has 2 issues: 1) it changes the userspace visible state 2) won't work with udp sendmsg cmsg