netdev - Re: [RFC net-next] net: tc: flow indirect framework issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4bb1c769-4539-bc97-b32b-a4b884dd297b@gmail.com>
Date:   Mon, 25 Apr 2022 09:52:49 +0200
From:   Mattias Forsblad <mattias.forsblad@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>,
        Pablo Neira Ayuso <pablo@...filter.org>
Cc:     Vladimir Oltean <olteanv@...il.com>,
        Baowen Zheng <baowen.zheng@...igine.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "roid@...dia.com" <roid@...dia.com>,
        "vladbu@...dia.com" <vladbu@...dia.com>,
        Eli Cohen <elic@...dia.com>, Jiri Pirko <jiri@...nulli.us>,
        Tobias Waldekranz <tobias@...dekranz.com>
Subject: Re: [RFC net-next] net: tc: flow indirect framework issue

On 2022-04-14 10:57, Jakub Kicinski wrote:
>> I think some people believe doing things fully transparent is good, at
>> the cost of adding more kernel complexity and hiding details that are
>> relevant to the user (such as if hardware offload is enabled for
>> vxlan0 and what is the real device that is actually being used for the
>> vxlan0 to be offloaded).
>>
>> So, there are no flags when setting up the vxlan0 device for the user
>> to say: "I would like to hardware offload vxlan0", and going slightly
>> further there is not "please attach this vxlan0 device to eth0 for
>> hardware offload". Any real device could be potentially used to
>> offload vxlan0, the user does not know which one is actually used.
>>
>> Exposing this information is a bit more work on top of the user, but:
>>
>> 1) it will be transparent: the control plane shows that the vxlan0 is
>>    hardware offloaded. Then if eth0 is gone, vxlan0 tc ingress can be
>>    removed too, because it depends on eth0.
>>
>> 2) The control plane validates if hardware offload for vxlan0. If this
>>    is not possible, display an error to the user: "sorry, I cannot
>>    offload vxlan0 on eth0 for reason X".
>>
>> Since this is not exposed to the control plane, the existing
>> infrastructure follows a snooping scheme, but tracking devices that
>> might be able to hardware offload.
>>
>> There is no obvious way to relate vxlan0 with the real device
>> (eth0) that is actually performing the hardware offloading.
> 
> Let's not over-complicate things, Mattias just needs replay to work.
> 90% sure it worked when we did the work back in the day with John H,
> before the nft rewrite etc.

To me the first thing to determine is how flow_indr_dev_register should work?
With only a superficial knowledge of tc I'd seem to me that if we
have a function called tcf_action_reoffload_cb and tc has all the information
about current blocks/filters/rules it should really reoffload those. The other way
would mean bookkeeping the same information at multiple places. It also
means restrictions on which sequence one should setup a network topology.
Would we like it that way?