netdev - [RFC]: raw packet filtering via tc-flower

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5be479fb-8fc6-4fa1-8a18-25be4c7b06f6@intel.com>
Date: Wed, 21 Feb 2024 12:43:47 -0700
From: Ahmed Zaki <ahmed.zaki@...el.com>
To: <stephen@...workplumber.org>, <davem@...emloft.net>,
	<edumazet@...gle.com>, <pabeni@...hat.com>, Jakub Kicinski <kuba@...nel.org>,
	<corbet@....net>, <jhs@...atatu.com>, <xiyou.wangcong@...il.com>,
	<jiri@...nulli.us>
CC: <netdev@...r.kernel.org>, "Chittim, Madhu" <madhu.chittim@...el.com>,
	"Samudrala, Sridhar" <sridhar.samudrala@...el.com>,
	<amritha.nambiar@...el.com>, Jan Sokolowski <jan.sokolowski@...el.com>
Subject: [RFC]: raw packet filtering via tc-flower

Hello,

Following on the discussion in [1] regarding raw packet filtering via 
ethtool and ntuple. To recap, we wanted to enable the user to offload 
filtering and flow direction using binary patterns of extended lengths 
and masks (e.g. 512 bytes). The conclusion was that ethtool and ntuple 
are deemed legacy and are not the best approach.

After some internal discussions, tc-flower seems to be another 
possibility. In [2], the skbedit and queue-mapping is now supported on 
the rx and the user can offload flow direction to a specific rx queue.

Can we extend tc-flower to support raw packet filtering, for example:

# tc filter add dev $IFACE ingress protocol 802_3 flower \
    offset $OFF pattern $BYTES mask $MASK \
    action skbedit queue_mapping $RXQ_ID skip_sw

where offset, pattern and mask are new the flower args, $BYTES and $MASK 
could be up to 512 bytes.

Any feedback is welcome.

Thank you,
Ahmed

1: 
https://lore.kernel.org/netdev/459ef75b-69dc-4baa-b7e4-6393b0b358ce@intel.com/ 

2: 
https://lore.kernel.org/netdev/166633911976.52141.3907831602027668289.stgit@anambiarhost.jf.intel.com/