netdev - Re: [RFC]: raw packet filtering via tc-flower

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZdhqhKbly60La_4h@nanopsycho>
Date: Fri, 23 Feb 2024 10:51:00 +0100
From: Jiri Pirko <jiri@...nulli.us>
To: Jakub Kicinski <kuba@...nel.org>
Cc: Ahmed Zaki <ahmed.zaki@...el.com>, stephen@...workplumber.org,
	davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com,
	corbet@....net, jhs@...atatu.com, xiyou.wangcong@...il.com,
	netdev@...r.kernel.org, "Chittim, Madhu" <madhu.chittim@...el.com>,
	"Samudrala, Sridhar" <sridhar.samudrala@...el.com>,
	amritha.nambiar@...el.com,
	Jan Sokolowski <jan.sokolowski@...el.com>
Subject: Re: [RFC]: raw packet filtering via tc-flower

Fri, Feb 23, 2024 at 03:40:45AM CET, kuba@...nel.org wrote:
>On Wed, 21 Feb 2024 12:43:47 -0700 Ahmed Zaki wrote:
>> Following on the discussion in [1] regarding raw packet filtering via 
>> ethtool and ntuple. To recap, we wanted to enable the user to offload 
>> filtering and flow direction using binary patterns of extended lengths 
>> and masks (e.g. 512 bytes). The conclusion was that ethtool and ntuple 
>> are deemed legacy and are not the best approach.
>> 
>> After some internal discussions, tc-flower seems to be another 
>> possibility. In [2], the skbedit and queue-mapping is now supported on 
>> the rx and the user can offload flow direction to a specific rx queue.
>> 
>> Can we extend tc-flower to support raw packet filtering, for example:
>> 
>> # tc filter add dev $IFACE ingress protocol 802_3 flower \
>>     offset $OFF pattern $BYTES mask $MASK \
>>     action skbedit queue_mapping $RXQ_ID skip_sw
>> 
>> where offset, pattern and mask are new the flower args, $BYTES and $MASK 
>> could be up to 512 bytes.
>
>Have you looked at cls_u32 offload?

Hmm, but why flower can't be extended this direction. I mean, it is very
convenient to match on well-defined fields. I can imagine that the
combination of match on well-defined fields and random chunks together
is completely valid use-case. Also, offloading of flower is
straightforward.

U32 is, well, not that convenient.