netdev - Re: Does skb_metadata_differs really need to stop GRO aggregation?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 30 Nov 2023 14:55:50 +0100
From: Toke Høiland-Jørgensen <toke@...hat.com>
To: Daniel Borkmann <daniel@...earbox.net>, Edward Cree
 <ecree.xilinx@...il.com>, Jesper Dangaard Brouer <hawk@...nel.org>
Cc: Yan Zhai <yan@...udflare.com>, Stanislav Fomichev <sdf@...gle.com>,
 Netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>, Alexei
 Starovoitov <ast@...nel.org>, kernel-team <kernel-team@...udflare.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Eric
 Dumazet <edumazet@...gle.com>, "David S. Miller" <davem@...emloft.net>,
 Jakub Sitnicki <jakub@...udflare.com>
Subject: Re: Does skb_metadata_differs really need to stop GRO aggregation?

Daniel Borkmann <daniel@...earbox.net> writes:

> On 11/29/23 10:52 PM, Toke Høiland-Jørgensen wrote:
>> Edward Cree <ecree.xilinx@...il.com> writes:
>>> On 28/11/2023 14:39, Toke Høiland-Jørgensen wrote:
>>>> I'm not quite sure what should be the semantics of that, though. I.e.,
>>>> if you are trying to aggregate two packets that have the flag set, which
>>>> packet do you take the value from? What if only one packet has the flag
>
> It would probably make sense if both packets have it set.

Right, so "aggregate only if both packets have the flag set, keeping the
metadata area from the first packet", then?

>>>> set? Or should we instead have a "metadata_xdp_only" flag that just
>>>> prevents the skb metadata field from being set entirely?
>
> What would be the use case compared to resetting meta data right before
> we return with XDP_PASS?

I was thinking it could save a call to xdp_adjust_meta() to reset it
back to zero before PASSing the packet. But okay, that may be of
marginal utility.

>>> Sounds like what's actually needed is bpf progs inside the GRO engine
>>>   to implement the metadata "protocol" prepare and coalesce callbacks?
>> 
>> Hmm, yes, I guess that would be the most general solution :)
>
> Feels like a potential good fit, agree, although for just solving the
> above sth not requiring extra BPF might be nice as well.

Yeah, I agree that just the flag makes sense on its own.

-Toke