netdev - Re: [PATCH bpf v2 5/8] bpf: Fix dev's rx stats for bpf_redirect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 13 Nov 2023 10:54:09 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Daniel Borkmann <daniel@...earbox.net>, martin.lau@...nel.org
Cc: kuba@...nel.org, sdf@...gle.com, netdev@...r.kernel.org,
 bpf@...r.kernel.org, Peilin Ye <peilin.ye@...edance.com>,
 Youlun Zhang <zhangyoulun@...edance.com>
Subject: Re: [PATCH bpf v2 5/8] bpf: Fix dev's rx stats for bpf_redirect_peer
 traffic

On 11/12/23 22:30, Daniel Borkmann wrote:
> From: Peilin Ye <peilin.ye@...edance.com>
> 
> Traffic redirected by bpf_redirect_peer() (used by recent CNIs like Cilium)
> is not accounted for in the RX stats of supported devices (that is, veth
> and netkit), confusing user space metrics collectors such as cAdvisor [0],
> as reported by Youlun.
> 
> Fix it by calling dev_sw_netstats_rx_add() in skb_do_redirect(), to update
> RX traffic counters. Devices that support ndo_get_peer_dev _must_ use the
> @tstats per-CPU counters (instead of @lstats, or @dstats).
> 
> To make this more fool-proof, error out when ndo_get_peer_dev is set but
> @tstats are not selected.
> 
>    [0] Specifically, the "container_network_receive_{byte,packet}s_total"
>        counters are affected.
> 
> Fixes: 9aa1206e8f48 ("bpf: Add redirect_peer helper")
> Reported-by: Youlun Zhang <zhangyoulun@...edance.com>
> Signed-off-by: Peilin Ye <peilin.ye@...edance.com>
> Co-developed-by: Daniel Borkmann <daniel@...earbox.net>
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> ---
>   net/core/dev.c    | 8 ++++++++
>   net/core/filter.c | 1 +
>   2 files changed, 9 insertions(+)
> 

Reviewed-by: Nikolay Aleksandrov <razor@...ckwall.org>