lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACGkMEtKdYX8SFC1VKZAwWAwr2C0Xgg54=j7P6bQCA+0y-Bh3g@mail.gmail.com>
Date: Mon, 26 Jun 2023 10:09:07 +0800
From: Jason Wang <jasowang@...hat.com>
To: Heng Qi <hengqi@...ux.alibaba.com>
Cc: netdev@...r.kernel.org, bpf@...r.kernel.org, 
	"Michael S . Tsirkin" <mst@...hat.com>, Xuan Zhuo <xuanzhuo@...ux.alibaba.com>, 
	"David S . Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Alexei Starovoitov <ast@...nel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Jesper Dangaard Brouer <hawk@...nel.org>, 
	John Fastabend <john.fastabend@...il.com>
Subject: Re: [PATCH net-next v2 1/3] virtio-net: reprobe csum related fields
 for skb passed by XDP

On Sun, Jun 25, 2023 at 3:28 PM Heng Qi <hengqi@...ux.alibaba.com> wrote:
>
> On Sun, Jun 25, 2023 at 02:44:07PM +0800, Jason Wang wrote:
> > On Sat, Jun 24, 2023 at 8:26 PM Heng Qi <hengqi@...ux.alibaba.com> wrote:
> > >
> > > Currently, the VIRTIO_NET_F_GUEST_CSUM (corresponds to NETIF_F_RXCSUM
> > > for netdev) feature of the virtio-net driver conflicts with the loading
> > > of XDP, which is caused by the problem described in [1][2], that is,
> > > XDP may cause errors in partial csumed-related fields which can lead
> > > to packet dropping.
> > >
> > > In addition, when communicating between vm and vm on the same host, the
> > > receiving side vm will receive packets marked as
> > > VIRTIO_NET_HDR_F_NEEDS_CSUM, but after these packets are processed by
> > > XDP, the VIRTIO_NET_HDR_F_NEEDS_CSUM and skb CHECKSUM_PARTIAL flags will
> > > be cleared, causing the packet dropping.
> > >
> > > This patch introduces a helper:
> > > 1. It will try to solve the above problems in the subsequent patch.
> > > 2. It parses UDP/TCP and calculates the pseudo-header checksum
> > > for virtio-net. virtio-net currently does not resolve VLANs nor
> > > SCTP CRC checksum offloading.
> >
> > Do we need to bother? Can we simply use skb_probe_transport_header()
> > and skb_checksum_help() which can simplify a lot of things?
>
> We need to. We only compute partial checksums (not complete checksums) for
> packets marked as NEEDS_CSUM. Please see skb_csum_unnecessary(), which will
> consider packets with the partial checksum to be valid by the
> protocol stack (Because it believes that the communication between the
> VMs of the same host is reliable.).
>
> In order to calculate the pseudo-header checksum, we need the IP address and the
> \field{check} position of the transport layer header.
> skb_probe_transport_header() only finds out the location of the
> transport header and does not provide us with other information we
> need. skb_checksum_help() is to calculate the complete checksum on the
> tx path, which is not our purpose.

A typo in my previous reply, actually, I meant skb_checksum_setup().

I think the point is to have a general purpose helper in the core
instead of duplicating codes in any specific driver.

Thanks

>
> Thanks!
>
> >
> > Thanks
> >
> > >
> > > [1] commit 18ba58e1c234 ("virtio-net: fail XDP set if guest csum is negotiated")
> > > [2] commit e59ff2c49ae1 ("virtio-net: disable guest csum during XDP set")
> > >
> > > Signed-off-by: Heng Qi <hengqi@...ux.alibaba.com>
> > > Reviewed-by: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>
> > > ---
> > >  drivers/net/virtio_net.c | 136 +++++++++++++++++++++++++++++++++++++++
> > >  1 file changed, 136 insertions(+)
> > >
> > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > index 5a7f7a76b920..83ab9257043a 100644
> > > --- a/drivers/net/virtio_net.c
> > > +++ b/drivers/net/virtio_net.c
> > > @@ -22,6 +22,7 @@
> > >  #include <net/route.h>
> > >  #include <net/xdp.h>
> > >  #include <net/net_failover.h>
> > > +#include <net/ip6_checksum.h>
> > >
> > >  static int napi_weight = NAPI_POLL_WEIGHT;
> > >  module_param(napi_weight, int, 0444);
> > > @@ -1568,6 +1569,141 @@ static void virtio_skb_set_hash(const struct virtio_net_hdr_v1_hash *hdr_hash,
> > >         skb_set_hash(skb, __le32_to_cpu(hdr_hash->hash_value), rss_hash_type);
> > >  }
> > >
> > > +static int virtnet_flow_dissect_udp_tcp(struct virtnet_info *vi, struct sk_buff *skb)
> > > +{
> > > +       struct net_device *dev = vi->dev;
> > > +       struct flow_keys_basic keys;
> > > +       struct udphdr *uh;
> > > +       struct tcphdr *th;
> > > +       int len, offset;
> > > +
> > > +       /* The flow dissector needs this information. */
> > > +       skb->dev = dev;
> > > +       skb_reset_mac_header(skb);
> > > +       skb->protocol = dev_parse_header_protocol(skb);
> > > +       /* virtio-net does not need to resolve VLAN. */
> > > +       skb_set_network_header(skb, ETH_HLEN);
> > > +       if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
> > > +                                             NULL, 0, 0, 0, 0))
> > > +               return -EINVAL;
> > > +
> > > +       /* 1. Pseudo-header checksum calculation requires:
> > > +        *    (1) saddr/daddr (2) IP_PROTO (3) length of transport payload
> > > +        * 2. We don't parse SCTP because virtio-net currently doesn't
> > > +        *    support CRC checksum offloading for SCTP.
> > > +        */
> > > +       if (keys.basic.n_proto == htons(ETH_P_IP)) {
> > > +               struct iphdr *iph;
> > > +
> > > +               /* Flow dissector has verified that there is an IP header.
> > > +                * So we do not need a pskb_may_pull().
> > > +                */
> > > +               iph = ip_hdr(skb);
> > > +               if (iph->version != 4)
> > > +                       return -EINVAL;
> > > +
> > > +               skb->transport_header = skb->mac_header + keys.control.thoff;
> > > +               offset = skb_transport_offset(skb);
> > > +               len = skb->len - offset;
> > > +               if (keys.basic.ip_proto == IPPROTO_UDP) {
> > > +                       if (!pskb_may_pull(skb, offset + sizeof(struct udphdr)))
> > > +                               return -EINVAL;
> > > +
> > > +                       uh = udp_hdr(skb);
> > > +                       skb->csum_offset = offsetof(struct udphdr, check);
> > > +                       /* Although uh->len is already the 3rd parameter for the calculation
> > > +                        * of the pseudo-header checksum, we have already calculated the
> > > +                        * length of the transport layer, so use 'len' here directly.
> > > +                        */
> > > +                       uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, len,
> > > +                                       IPPROTO_UDP, 0);
> > > +               } else if (keys.basic.ip_proto == IPPROTO_TCP) {
> > > +                       if (!pskb_may_pull(skb, offset + sizeof(struct tcphdr)))
> > > +                               return -EINVAL;
> > > +
> > > +                       th = tcp_hdr(skb);
> > > +                       skb->csum_offset = offsetof(struct tcphdr, check);
> > > +                       th->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, len,
> > > +                                       IPPROTO_TCP, 0);
> > > +               } /* virtio-net doesn't support checksums for SCTP crc hw offloading.*/
> > > +       } else if (keys.basic.n_proto == htons(ETH_P_IPV6)) {
> > > +               struct ipv6hdr *ip6h;
> > > +
> > > +               ip6h = ipv6_hdr(skb);
> > > +               if (ip6h->version != 6)
> > > +                       return -EINVAL;
> > > +
> > > +               /* We have skipped the possible extension headers for IPv6.
> > > +                * If there is a Routing Header, the tx's check value is calculated by
> > > +                * final_dst, and that value is the rx's daddr.
> > > +                */
> > > +               skb->transport_header = skb->mac_header + keys.control.thoff;
> > > +               offset = skb_transport_offset(skb);
> > > +               len = skb->len - offset;
> > > +               if (keys.basic.ip_proto == IPPROTO_UDP) {
> > > +                       if (!pskb_may_pull(skb, offset + sizeof(struct udphdr)))
> > > +                               return -EINVAL;
> > > +
> > > +                       uh = udp_hdr(skb);
> > > +                       skb->csum_offset = offsetof(struct udphdr, check);
> > > +                       uh->check = ~csum_ipv6_magic((const struct in6_addr *)&ip6h->saddr,
> > > +                                       (const struct in6_addr *)&ip6h->daddr,
> > > +                                       len, IPPROTO_UDP, 0);
> > > +               } else if (keys.basic.ip_proto == IPPROTO_TCP) {
> > > +                       if (!pskb_may_pull(skb, offset + sizeof(struct tcphdr)))
> > > +                               return -EINVAL;
> > > +
> > > +                       th = tcp_hdr(skb);
> > > +                       skb->csum_offset = offsetof(struct tcphdr, check);
> > > +                       th->check = ~csum_ipv6_magic((const struct in6_addr *)&ip6h->saddr,
> > > +                                       (const struct in6_addr *)&ip6h->daddr,
> > > +                                       len, IPPROTO_TCP, 0);
> > > +               }
> > > +       }
> > > +
> > > +       skb->csum_start = skb->transport_header;
> > > +
> > > +       return 0;
> > > +}
> > > +
> > > +static int virtnet_set_csum_after_xdp(struct virtnet_info *vi,
> > > +                                     struct sk_buff *skb,
> > > +                                     __u8 flags)
> > > +{
> > > +       int err;
> > > +
> > > +       /* When XDP program is loaded, for example, the vm-vm scenario
> > > +        * on the same host, packets marked as VIRTIO_NET_HDR_F_NEEDS_CSUM
> > > +        * will travel. Although these packets are safe from the point of
> > > +        * view of the vm, to avoid modification by XDP and successful
> > > +        * forwarding in the upper layer, we re-probe the necessary checksum
> > > +        * related information: skb->csum_{start, offset}, pseudo-header csum.
> > > +        *
> > > +        * This benefits us:
> > > +        * 1. XDP can be loaded when there's _F_GUEST_CSUM.
> > > +        * 2. The device verifies the checksum of packets , especially
> > > +        *    benefiting for large packets.
> > > +        * 3. In the same-host vm-vm scenario, packets marked as
> > > +        *    VIRTIO_NET_HDR_F_NEEDS_CSUM are no longer dropped after being
> > > +        *    processed by XDP.
> > > +        */
> > > +       if (flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
> > > +               err = virtnet_flow_dissect_udp_tcp(vi, skb);
> > > +               if (err < 0)
> > > +                       return -EINVAL;
> > > +
> > > +               skb->ip_summed = CHECKSUM_PARTIAL;
> > > +       } else if (flags & VIRTIO_NET_HDR_F_DATA_VALID) {
> > > +               /* We want to benefit from this: XDP guarantees that packets marked
> > > +                * as VIRTIO_NET_HDR_F_DATA_VALID still have correct csum after they
> > > +                * are processed.
> > > +                */
> > > +               skb->ip_summed = CHECKSUM_UNNECESSARY;
> > > +       }
> > > +
> > > +       return 0;
> > > +}
> > > +
> > >  static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
> > >                         void *buf, unsigned int len, void **ctx,
> > >                         unsigned int *xdp_xmit,
> > > --
> > > 2.19.1.6.gb485710b
> > >
>


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ