netdev - Re: Does skb_metadata_differs really need to stop GRO aggregation?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 30 Nov 2023 00:10:00 +0100
From: Daniel Borkmann <daniel@...earbox.net>
To: Toke Høiland-Jørgensen <toke@...hat.com>,
 Edward Cree <ecree.xilinx@...il.com>,
 Jesper Dangaard Brouer <hawk@...nel.org>
Cc: Yan Zhai <yan@...udflare.com>, Stanislav Fomichev <sdf@...gle.com>,
 Netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
 Alexei Starovoitov <ast@...nel.org>, kernel-team
 <kernel-team@...udflare.com>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
 "David S. Miller" <davem@...emloft.net>,
 Jakub Sitnicki <jakub@...udflare.com>
Subject: Re: Does skb_metadata_differs really need to stop GRO aggregation?

On 11/29/23 10:52 PM, Toke Høiland-Jørgensen wrote:
> Edward Cree <ecree.xilinx@...il.com> writes:
>> On 28/11/2023 14:39, Toke Høiland-Jørgensen wrote:
>>> I'm not quite sure what should be the semantics of that, though. I.e.,
>>> if you are trying to aggregate two packets that have the flag set, which
>>> packet do you take the value from? What if only one packet has the flag

It would probably make sense if both packets have it set.

>>> set? Or should we instead have a "metadata_xdp_only" flag that just
>>> prevents the skb metadata field from being set entirely?

What would be the use case compared to resetting meta data right before
we return with XDP_PASS?

>> Sounds like what's actually needed is bpf progs inside the GRO engine
>>   to implement the metadata "protocol" prepare and coalesce callbacks?
> 
> Hmm, yes, I guess that would be the most general solution :)

Feels like a potential good fit, agree, although for just solving the
above sth not requiring extra BPF might be nice as well.

Thanks,
Daniel