netdev - [PATCH bpf-next 0/3] Support direct writes to nf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <cover.1660592020.git.dxu@dxuuu.xyz>
Date:   Mon, 15 Aug 2022 13:35:45 -0600
From:   Daniel Xu <dxu@...uu.xyz>
To:     bpf@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        andrii@...nel.org, memxor@...il.com
Cc:     Daniel Xu <dxu@...uu.xyz>, pablo@...filter.org, fw@...len.de,
        netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH bpf-next 0/3] Support direct writes to nf_conn:mark

Support direct writes to nf_conn:mark from TC and XDP prog types. This
is useful when applications want to store per-connection metadata. This
is also particularly useful for applications that run both bpf and
iptables/nftables because the latter can trivially access this metadata.

One example use case would be if a bpf prog is responsible for advanced
packet classification and iptables/nftables is later used for routing
due to pre-existing/legacy code.

Daniel Xu (3):
  bpf: Remove duplicate PTR_TO_BTF_ID RO check
  bpf: Add support for writing to nf_conn:mark
  selftests/bpf: Add tests for writing to nf_conn:mark

 include/net/netfilter/nf_conntrack_bpf.h      | 18 +++++++
 kernel/bpf/verifier.c                         |  3 --
 net/core/filter.c                             | 34 +++++++++++++
 net/netfilter/nf_conntrack_bpf.c              | 50 +++++++++++++++++++
 .../testing/selftests/bpf/prog_tests/bpf_nf.c |  1 +
 .../testing/selftests/bpf/progs/test_bpf_nf.c |  6 ++-
 .../selftests/bpf/progs/test_bpf_nf_fail.c    | 14 ++++++
 7 files changed, 121 insertions(+), 5 deletions(-)

-- 
2.37.1