netdev - Re: [PATCH 10/12] flow_dissector: Parse Geneve in UDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALx6S34V6J7oxsqBVyGb+AsT0c1khuB+mDBPNiWZSRjgRoxqsQ@mail.gmail.com>
Date: Thu, 15 Aug 2024 13:03:18 -0700
From: Tom Herbert <tom@...bertland.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, edumazet@...gle.com, 
	netdev@...r.kernel.org, felipe@...anda.io
Subject: Re: [PATCH 10/12] flow_dissector: Parse Geneve in UDP

On Sat, Aug 3, 2024 at 12:13 PM Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
>
> Tom Herbert wrote:
> > Parse Geneve in a UDP encapsulation
> >
> > Signed-off-by: Tom Herbert <tom@...bertland.com>
> > ---
> >  net/core/flow_dissector.c | 29 +++++++++++++++++++++++++++++
> >  1 file changed, 29 insertions(+)
> >
> > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
> > index 3766dc4d5b23..4fff60233992 100644
> > --- a/net/core/flow_dissector.c
> > +++ b/net/core/flow_dissector.c
> > @@ -11,6 +11,7 @@
> >  #include <net/fou.h>
> >  #include <net/ip.h>
> >  #include <net/ipv6.h>
> > +#include <net/geneve.h>
> >  #include <net/gre.h>
> >  #include <net/pptp.h>
> >  #include <net/tipc.h>
> > @@ -808,6 +809,29 @@ __skb_flow_dissect_vxlan(const struct sk_buff *skb,
> >       return FLOW_DISSECT_RET_PROTO_AGAIN;
> >  }
> >
> > +static enum flow_dissect_ret
> > +__skb_flow_dissect_geneve(const struct sk_buff *skb,
> > +                       struct flow_dissector *flow_dissector,
> > +                       void *target_container, const void *data,
> > +                       __be16 *p_proto, int *p_nhoff, int hlen,
> > +                       unsigned int flags)
> > +{
> > +     struct genevehdr *hdr, _hdr;
> > +
> > +     hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr), data, hlen,
> > +                                &_hdr);
> > +     if (!hdr)
> > +             return FLOW_DISSECT_RET_OUT_BAD;
> > +
> > +     if (hdr->ver != 0)
> > +             return FLOW_DISSECT_RET_OUT_GOOD;
> > +
> > +     *p_proto = hdr->proto_type;
> > +     *p_nhoff += sizeof(struct genevehdr) + (hdr->opt_len * 4);
> > +
> > +     return FLOW_DISSECT_RET_PROTO_AGAIN;
>
> Do you want to return FLOW_DISSECT_RET_OUT_GOOD if IPPROTO 59.
>
> Per your spec: "IP protocol number 59 ("No next header") may be set to
> indicate that the GUE payload does not begin with the header of an IP
> protocol."
>
> Admittedly pendantic. No idea if any implementation actually sets
> this.

It is a legal value in an IPv6 next header field. I'll add
IPPROTO_NONXTHDR and handling in flow dissector.

Tom

>
> > +}
> > +
> >  /**
> >   * __skb_flow_dissect_batadv() - dissect batman-adv header
> >   * @skb: sk_buff to with the batman-adv header
> > @@ -974,6 +998,11 @@ __skb_flow_dissect_udp(const struct sk_buff *skb, struct net *net,
> >                                              target_container, data,
> >                                              p_proto, &nhoff, hlen, flags);
> >               break;
> > +     case UDP_ENCAP_GENEVE:
> > +             ret = __skb_flow_dissect_geneve(skb, flow_dissector,
> > +                                             target_container, data,
> > +                                             p_proto, &nhoff, hlen, flags);
> > +             break;
> >       default:
> >               break;
> >       }
> > --
> > 2.34.1
> >
>
>