netdev - Re: [RFC]: raw packet filtering via tc-flower

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b4ed432e-6e76-8f1b-c5ea-8f19ba610ef3@gmail.com>
Date: Fri, 23 Feb 2024 12:07:06 +0000
From: Edward Cree <ecree.xilinx@...il.com>
To: Jiri Pirko <jiri@...nulli.us>
Cc: Ahmed Zaki <ahmed.zaki@...el.com>, stephen@...workplumber.org,
 davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com, corbet@....net,
 jhs@...atatu.com, xiyou.wangcong@...il.com, netdev@...r.kernel.org,
 "Chittim, Madhu" <madhu.chittim@...el.com>,
 "Samudrala, Sridhar" <sridhar.samudrala@...el.com>,
 amritha.nambiar@...el.com, Jan Sokolowski <jan.sokolowski@...el.com>,
 Jakub Kicinski <kuba@...nel.org>
Subject: Re: [RFC]: raw packet filtering via tc-flower

On 23/02/2024 09:51, Jiri Pirko wrote:
> Hmm, but why flower can't be extended this direction. I mean, it is very
> convenient to match on well-defined fields.

Flower is intrinsically tied to the flow dissector, both conceptually
 and in implementation.  I'm not sure it's appropriate for it to become
 a dumping ground for random vendor filtering extensions/capabilities.

> U32 is, well, not that convenient.

How about a new classifier that just does this raw matching?

> I can imagine that the
> combination of match on well-defined fields and random chunks together
> is completely valid use-case.

But is it likely to be something that hardware supports?  (Since the
 motivation for this feature is clearly the hardware offload — otherwise
 there are other mechanisms like BPF for arbitrary packet filtering.)

As the vendor behind this, one hopes Intel can comment on both the
 hardware and the use-case side of this question.