lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240113223533.GA3929032@sniper.kasperd.net>
Date: Sat, 13 Jan 2024 23:35:33 +0100
From: Kasper Dupont <kasperd@...rd.13.jan.2024.kasperd.net>
To: netdev@...r.kernel.org
Subject: Receiving GENEVE packets for one VNI in user mode

Is there a way for a user mode program to receive GENEVE packets
targeted at one specified VNI? None of the GENEVE related webpages I
have been reading through have brought me closer to an answer.

I can think of three different approaches, but each come with its
own problems making it not look like a viable solution.


Approach 1:

The most straightforward approach I can think of is to open a UDP
socket attach BPF rules to filter on VNI and bind it to port 6081.
This should work as long as there is nothing else on the host using
GENEVE.

But I don't see any way to get this approach working if multiple
programs are to receive GENEVE packets for different VNI and
simultaneously use the kernel drivers to receive packets for other
VNI.

Approach 2:

Use a raw socket to receive all UDP packets. Because there is a
possibility that packets arrive fragmented it has to duplicate the
reasembly work in user mode. And because the VNI will only be present
in one fragment, filtering has to be done after reassembly. So I
couldn't rely on BPF.

This approach seems possible but very inefficient.

Approach 3:

Use ip-link(8) to create a tunnel device and bind a raw socket to that
virtual interface. This will however only receive the encapsulated
packets and not the GENEVE header, so it would be unsuitable for any
use case that needs the actual GENEVE header. It would also lose all
packets with critical options that aren't understood by the kernel but
may be understood by the user mode program.


Is there a way to make one of these approaches work or some other way
to achieve it?

If it is impossible to do in user mode do you think a kernel module to
add the functionality would be possible with the current kernel code?

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ