lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 11 May 2022 14:48:21 +0300 From: Maxim Mikityanskiy <maximmi@...dia.com> To: Andrii Nakryiko <andrii.nakryiko@...il.com> Cc: bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Networking <netdev@...r.kernel.org>, Tariq Toukan <tariqt@...dia.com>, Martin KaFai Lau <kafai@...com>, Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>, John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>, "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Eric Dumazet <edumazet@...gle.com>, Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>, David Ahern <dsahern@...nel.org>, Shuah Khan <shuah@...nel.org>, Jesper Dangaard Brouer <hawk@...nel.org>, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Joe Stringer <joe@...ium.io>, Florent Revest <revest@...omium.org>, "open list:KERNEL SELFTEST FRAMEWORK" <linux-kselftest@...r.kernel.org>, Toke Høiland-Jørgensen <toke@...e.dk>, Kumar Kartikeya Dwivedi <memxor@...il.com>, Florian Westphal <fw@...len.de>, pabeni@...hat.com Subject: Re: [PATCH bpf-next v9 0/5] New BPF helpers to accelerate synproxy On 2022-05-11 02:59, Andrii Nakryiko wrote: > On Tue, May 10, 2022 at 12:21 PM Maxim Mikityanskiy <maximmi@...dia.com> wrote: >> >> On 2022-05-07 00:51, Andrii Nakryiko wrote: >>> On Tue, May 3, 2022 at 10:14 AM Maxim Mikityanskiy <maximmi@...dia.com> wrote: >>>> >>>> The first patch of this series is a documentation fix. >>>> >>>> The second patch allows BPF helpers to accept memory regions of fixed >>>> size without doing runtime size checks. >>>> >>>> The two next patches add new functionality that allows XDP to >>>> accelerate iptables synproxy. >>>> >>>> v1 of this series [1] used to include a patch that exposed conntrack >>>> lookup to BPF using stable helpers. It was superseded by series [2] by >>>> Kumar Kartikeya Dwivedi, which implements this functionality using >>>> unstable helpers. >>>> >>>> The third patch adds new helpers to issue and check SYN cookies without >>>> binding to a socket, which is useful in the synproxy scenario. >>>> >>>> The fourth patch adds a selftest, which includes an XDP program and a >>>> userspace control application. The XDP program uses socketless SYN >>>> cookie helpers and queries conntrack status instead of socket status. >>>> The userspace control application allows to tune parameters of the XDP >>>> program. This program also serves as a minimal example of usage of the >>>> new functionality. >>>> >>>> The last patch exposes the new helpers to TC BPF. >>>> >>>> The draft of the new functionality was presented on Netdev 0x15 [3]. >>>> >>>> v2 changes: >>>> >>>> Split into two series, submitted bugfixes to bpf, dropped the conntrack >>>> patches, implemented the timestamp cookie in BPF using bpf_loop, dropped >>>> the timestamp cookie patch. >>>> >>>> v3 changes: >>>> >>>> Moved some patches from bpf to bpf-next, dropped the patch that changed >>>> error codes, split the new helpers into IPv4/IPv6, added verifier >>>> functionality to accept memory regions of fixed size. >>>> >>>> v4 changes: >>>> >>>> Converted the selftest to the test_progs runner. Replaced some >>>> deprecated functions in xdp_synproxy userspace helper. >>>> >>>> v5 changes: >>>> >>>> Fixed a bug in the selftest. Added questionable functionality to support >>>> new helpers in TC BPF, added selftests for it. >>>> >>>> v6 changes: >>>> >>>> Wrap the new helpers themselves into #ifdef CONFIG_SYN_COOKIES, replaced >>>> fclose with pclose and fixed the MSS for IPv6 in the selftest. >>>> >>>> v7 changes: >>>> >>>> Fixed the off-by-one error in indices, changed the section name to >>>> "xdp", added missing kernel config options to vmtest in CI. >>>> >>>> v8 changes: >>>> >>>> Properly rebased, dropped the first patch (the same change was applied >>>> by someone else), updated the cover letter. >>>> >>>> v9 changes: >>>> >>>> Fixed selftests for no_alu32. >>>> >>>> [1]: https://lore.kernel.org/bpf/20211020095815.GJ28644@breakpoint.cc/t/ >>>> [2]: https://lore.kernel.org/bpf/20220114163953.1455836-1-memxor@gmail.com/ >>>> [3]: https://netdevconf.info/0x15/session.html?Accelerating-synproxy-with-XDP >>>> >>>> Maxim Mikityanskiy (5): >>>> bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie >>>> bpf: Allow helpers to accept pointers with a fixed size >>>> bpf: Add helpers to issue and check SYN cookies in XDP >>>> bpf: Add selftests for raw syncookie helpers >>>> bpf: Allow the new syncookie helpers to work with SKBs >>>> >>> >>> Is it expected that your selftests will fail on s390x? Please check [0] >> >> I see it fails with: >> >> test_synproxy:FAIL:ethtool -K tmp0 tx off unexpected error: 32512 (errno 2) >> >> errno 2 is ENOENT, probably the ethtool binary is missing from the s390x >> image? When reviewing v6, you said you added ethtool to the CI image. >> Maybe it was added to x86_64 only? Could you add it to s390x? >> > > Could be that it was outdated in s390x, but with [0] just merged in it > should have pretty recent one. Do you mean the image was outdated and didn't contain ethtool? Or ethtool was in the image, but was outdated? If the latter, I would expect it to work, this specific ethtool command has worked for ages. > [0] https://github.com/libbpf/ci/pull/16 > >> [1]: >> https://patchwork.kernel.org/project/netdevbpf/patch/20220422172422.4037988-6-maximmi@nvidia.com/ >> >>> [0] https://github.com/kernel-patches/bpf/runs/6277764463?check_suite_focus=true#step:6:6130 >>> >>>> include/linux/bpf.h | 10 + >>>> include/net/tcp.h | 1 + >>>> include/uapi/linux/bpf.h | 88 +- >>>> kernel/bpf/verifier.c | 26 +- >>>> net/core/filter.c | 128 +++ >>>> net/ipv4/tcp_input.c | 3 +- >>>> scripts/bpf_doc.py | 4 + >>>> tools/include/uapi/linux/bpf.h | 88 +- >>>> tools/testing/selftests/bpf/.gitignore | 1 + >>>> tools/testing/selftests/bpf/Makefile | 5 +- >>>> .../selftests/bpf/prog_tests/xdp_synproxy.c | 144 +++ >>>> .../selftests/bpf/progs/xdp_synproxy_kern.c | 819 ++++++++++++++++++ >>>> tools/testing/selftests/bpf/xdp_synproxy.c | 466 ++++++++++ >>>> 13 files changed, 1761 insertions(+), 22 deletions(-) >>>> create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c >>>> create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c >>>> create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c >>>> >>>> -- >>>> 2.30.2 >>>> >>
Powered by blists - more mailing lists