netdev - Re: [PATCH bpf-next v5 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220112195732.4vlkuowaiyc4k24t@kafai-mbp.dhcp.thefacebook.com>
Date:   Wed, 12 Jan 2022 11:57:32 -0800
From:   Martin KaFai Lau <kafai@...com>
To:     Tyler Wear <quic_twear@...cinc.com>
CC:     <netdev@...r.kernel.org>, <bpf@...r.kernel.org>, <maze@...gle.com>,
        <yhs@...com>, <toke@...hat.com>, <daniel@...earbox.net>,
        <song@...nel.org>
Subject: Re: [PATCH bpf-next v5 1/2] Add skb_store_bytes() for
 BPF_PROG_TYPE_CGROUP_SKB

On Mon, Jan 10, 2022 at 04:00:00PM -0800, Tyler Wear wrote:
> Need to modify the ds field to support upcoming Wifi QoS Alliance spec.
> Instead of adding generic function for just modifying the ds field,
> add skb_store_bytes for BPF_PROG_TYPE_CGROUP_SKB.
> This allows other fields in the network and transport header to be
> modified in the future.
> 
> Checksum API's also need to be added for completeness.
> 
> It is not possible to use CGROUP_(SET|GET)SOCKOPT since
> the policy may change during runtime and would result
> in a large number of entries with wildcards.
> 
> V4 patch fixes warnings and errors from checkpatch.
> 
> The existing check for bpf_try_make_writable() should mean that
> skb_share_check() is not needed.
> 
> Signed-off-by: Tyler Wear <quic_twear@...cinc.com>
> ---
>  net/core/filter.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 6102f093d59a..ce01a8036361 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -7299,6 +7299,16 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>  		return &bpf_sk_storage_delete_proto;
>  	case BPF_FUNC_perf_event_output:
>  		return &bpf_skb_event_output_proto;
> +	case BPF_FUNC_skb_store_bytes:
> +		return &bpf_skb_store_bytes_proto;
> +	case BPF_FUNC_csum_update:
> +		return &bpf_csum_update_proto;
> +	case BPF_FUNC_csum_level:
> +		return &bpf_csum_level_proto;
> +	case BPF_FUNC_l3_csum_replace:
> +		return &bpf_l3_csum_replace_proto;
> +	case BPF_FUNC_l4_csum_replace:
> +		return &bpf_l4_csum_replace_proto;
BPF_FUNC_csum_diff should also be added to support
updating >4 bytes (e.g. ipv6 addr).