netdev - RE: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BYAPR02MB523881040F40526ED9795993AA589@BYAPR02MB5238.namprd02.prod.outlook.com>
Date:   Tue, 18 Jan 2022 22:23:36 +0000
From:   Tyler Wear <twear@...cinc.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Maciej Żenczykowski <maze@...gle.com>
CC:     "Tyler Wear (QUIC)" <quic_twear@...cinc.com>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, Yonghong Song <yhs@...com>,
        Martin KaFai Lau <kafai@...com>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Song Liu <song@...nel.org>
Subject: RE: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for
 BPF_PROG_TYPE_CGROUP_SKB



> -----Original Message-----
> From: Alexei Starovoitov <alexei.starovoitov@...il.com>
> Sent: Tuesday, January 18, 2022 12:38 PM
> To: Maciej Żenczykowski <maze@...gle.com>
> Cc: Tyler Wear (QUIC) <quic_twear@...cinc.com>; Network Development
> <netdev@...r.kernel.org>; bpf <bpf@...r.kernel.org>; Yonghong Song
> <yhs@...com>; Martin KaFai Lau <kafai@...com>; Toke Høiland-Jørgensen
> <toke@...hat.com>; Daniel Borkmann <daniel@...earbox.net>; Song Liu
> <song@...nel.org>
> Subject: Re: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for
> BPF_PROG_TYPE_CGROUP_SKB
> 
> WARNING: This email originated from outside of Qualcomm. Please be wary
> of any links or attachments, and do not enable macros.
> 
> On Fri, Jan 14, 2022 at 1:18 PM Maciej Żenczykowski <maze@...gle.com>
> wrote:
> >
> > > > > > This is wrong.
> > > > > > CGROUP_INET_EGRESS bpf prog cannot arbitrary change packet
> data.
> >
> > I agree with this sentiment, which is why the original proposal was
> > simply to add a helper which is only capable of modifying the
> > tos/tclass/dscp field, and not any arbitrary bytes.  (note: there
> > already is such a helper to set the ECN congestion notification bits,
> > so there's somewhat of a precedent)
> 
> True. bpf_skb_ecn_set_ce() is available to cg_skb progs.
> An arbitrary tos rewriting helper would screw it up.

Patch 1 was for a ds_field helper to modify the top 6 bits of TOS, not an arbitrary rewriting.
This should suffice since it doesn't interfere with CE.