netdev - Re: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQKHacT7gb1CMW8z_+SR-a8ZoS8ze=L-u9bh5-QZzXju7Q@mail.gmail.com>
Date:   Tue, 18 Jan 2022 14:31:22 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Tyler Wear <twear@...cinc.com>
Cc:     Maciej Żenczykowski <maze@...gle.com>,
        "Tyler Wear (QUIC)" <quic_twear@...cinc.com>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, Yonghong Song <yhs@...com>,
        Martin KaFai Lau <kafai@...com>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Song Liu <song@...nel.org>
Subject: Re: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for BPF_PROG_TYPE_CGROUP_SKB

On Tue, Jan 18, 2022 at 2:23 PM Tyler Wear <twear@...cinc.com> wrote:
>
>
>
> > -----Original Message-----
> > From: Alexei Starovoitov <alexei.starovoitov@...il.com>
> > Sent: Tuesday, January 18, 2022 12:38 PM
> > To: Maciej Żenczykowski <maze@...gle.com>
> > Cc: Tyler Wear (QUIC) <quic_twear@...cinc.com>; Network Development
> > <netdev@...r.kernel.org>; bpf <bpf@...r.kernel.org>; Yonghong Song
> > <yhs@...com>; Martin KaFai Lau <kafai@...com>; Toke Høiland-Jørgensen
> > <toke@...hat.com>; Daniel Borkmann <daniel@...earbox.net>; Song Liu
> > <song@...nel.org>
> > Subject: Re: [PATCH bpf-next v6 1/2] Add skb_store_bytes() for
> > BPF_PROG_TYPE_CGROUP_SKB
> >
> > WARNING: This email originated from outside of Qualcomm. Please be wary
> > of any links or attachments, and do not enable macros.
> >
> > On Fri, Jan 14, 2022 at 1:18 PM Maciej Żenczykowski <maze@...gle.com>
> > wrote:
> > >
> > > > > > > This is wrong.
> > > > > > > CGROUP_INET_EGRESS bpf prog cannot arbitrary change packet
> > data.
> > >
> > > I agree with this sentiment, which is why the original proposal was
> > > simply to add a helper which is only capable of modifying the
> > > tos/tclass/dscp field, and not any arbitrary bytes.  (note: there
> > > already is such a helper to set the ECN congestion notification bits,
> > > so there's somewhat of a precedent)
> >
> > True. bpf_skb_ecn_set_ce() is available to cg_skb progs.
> > An arbitrary tos rewriting helper would screw it up.
>
> Patch 1 was for a ds_field helper to modify the top 6 bits of TOS, not an arbitrary rewriting.
> This should suffice since it doesn't interfere with CE.

I still don't hear the answer why tc bpf is not sufficient.