| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <66bfa3fc590da_184d66294a7@willemb.c.googlers.com.notmuch>
Date: Fri, 16 Aug 2024 15:09:48 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Tom Herbert <tom@...bertland.com>,
davem@...emloft.net,
kuba@...nel.org,
edumazet@...gle.com,
netdev@...r.kernel.org,
felipe@...anda.io,
willemdebruijn.kernel@...il.com
Cc: Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH net-next v2 04/12] flow_dissector: UDP encap
infrastructure
Tom Herbert wrote:
> Add infrastructure for parsing into UDP encapsulations
>
> Add function __skb_flow_dissect_udp that is called for IPPROTO_UDP.
> The flag FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS enables parsing of UDP
> encapsulations. If the flag is set when parsing a UDP packet then
> a socket lookup is performed. The offset of the base network header,
> either an IPv4 or IPv6 header, is tracked and passed to
> __skb_flow_dissect_udp so that it can perform the socket lookup
>
> If a socket is found and it's for a UDP encapsulation (encap_type is
> set in the UDP socket) then a switch is performed on the encap_type
> value (cases are UDP_ENCAP_* values)
>
> An encapsulated packet in UDP can either be indicated by an
> EtherType or IP protocol. The processing for dissecting a UDP encap
> protocol returns a flow dissector return code. If
> FLOW_DISSECT_RET_PROTO_AGAIN or FLOW_DISSECT_RET_IPPROTO_AGAIN is
> returned then the corresponding encapsulated protocol is dissected.
> The nhoff is set to point to the header to process. In the case
> FLOW_DISSECT_RET_PROTO_AGAIN the EtherType protocol is returned and
> the IP protocol is set to zero. In the case of
> FLOW_DISSECT_RET_IPPROTO_AGAIN, the IP protocol is returned and
> the EtherType protocol is returned unchanged
>
> Signed-off-by: Tom Herbert <tom@...bertland.com>
> ---
> include/net/flow_dissector.h | 1 +
> net/core/flow_dissector.c | 121 +++++++++++++++++++++++++++++++++++
> 2 files changed, 122 insertions(+)
>
> diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
> index ced79dc8e856..8a868a88a6f1 100644
> --- a/include/net/flow_dissector.h
> +++ b/include/net/flow_dissector.h
> @@ -384,6 +384,7 @@ enum flow_dissector_key_id {
> #define FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL BIT(1)
> #define FLOW_DISSECTOR_F_STOP_AT_ENCAP BIT(2)
> #define FLOW_DISSECTOR_F_STOP_BEFORE_ENCAP BIT(3)
> +#define FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS BIT(4)
>
> struct flow_dissector_key {
> enum flow_dissector_key_id key_id;
> diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
> index 4b116119086a..160801b83d54 100644
> --- a/net/core/flow_dissector.c
> +++ b/net/core/flow_dissector.c
> @@ -13,6 +13,7 @@
> #include <net/gre.h>
> #include <net/pptp.h>
> #include <net/tipc.h>
> +#include <net/udp.h>
> #include <linux/igmp.h>
> #include <linux/icmp.h>
> #include <linux/sctp.h>
> @@ -806,6 +807,117 @@ __skb_flow_dissect_batadv(const struct sk_buff *skb,
> return FLOW_DISSECT_RET_PROTO_AGAIN;
> }
>
> +static enum flow_dissect_ret
> +__skb_flow_dissect_udp(const struct sk_buff *skb, const struct net *net,
> + struct flow_dissector *flow_dissector,
> + void *target_container, const void *data,
> + int *p_nhoff, int hlen, __be16 *p_proto,
> + u8 *p_ip_proto, int base_nhoff, unsigned int flags)
> +{
> + enum flow_dissect_ret ret;
> + const struct udphdr *udph;
> + struct udphdr _udph;
> + struct sock *sk;
> + __u8 encap_type;
> + int nhoff;
> +
> + if (!(flags & FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS))
> + return FLOW_DISSECT_RET_OUT_GOOD;
> +
> + switch (*p_proto) {
> + case htons(ETH_P_IP): {
> + const struct iphdr *iph;
> + struct iphdr _iph;
> +
> + iph = __skb_header_pointer(skb, base_nhoff, sizeof(_iph), data,
> + hlen, &_iph);
> + if (!iph)
> + return FLOW_DISSECT_RET_OUT_BAD;
> +
> + udph = __skb_header_pointer(skb, *p_nhoff, sizeof(_udph), data,
> + hlen, &_udph);
> + if (!udph)
> + return FLOW_DISSECT_RET_OUT_BAD;
> +
> + rcu_read_lock();
> + /* Look up the UDPv4 socket and get the encap_type */
> + sk = __udp4_lib_lookup(net, iph->saddr, udph->source,
> + iph->daddr, udph->dest,
> + inet_iif(skb), inet_sdif(skb),
> + net->ipv4.udp_table, NULL);
> + if (!sk || !udp_sk(sk)->encap_type) {
> + rcu_read_unlock();
> + return FLOW_DISSECT_RET_OUT_GOOD;
> + }
> +
> + encap_type = udp_sk(sk)->encap_type;
> + rcu_read_unlock();
> +
> + break;
> + }
> +#if IS_ENABLED(CONFIG_IPV6)
> + case htons(ETH_P_IPV6): {
> + const struct ipv6hdr *iph;
> + struct ipv6hdr _iph;
> +
> + if (!likely(ipv6_bpf_stub))
> + return FLOW_DISSECT_RET_OUT_GOOD;
> +
> + iph = __skb_header_pointer(skb, base_nhoff, sizeof(_iph), data,
> + hlen, &_iph);
> + if (!iph)
> + return FLOW_DISSECT_RET_OUT_BAD;
> +
> + udph = __skb_header_pointer(skb, *p_nhoff, sizeof(_udph), data,
> + hlen, &_udph);
> + if (!udph)
> + return FLOW_DISSECT_RET_OUT_BAD;
> +
> + rcu_read_lock();
> + /* Look up the UDPv6 socket and get the encap_type */
> + sk = ipv6_bpf_stub->udp6_lib_lookup(net,
Should this use ipv6_stub?
> + &iph->saddr, udph->source,
> + &iph->daddr, udph->dest,
> + inet_iif(skb), inet_sdif(skb),
> + net->ipv4.udp_table, NULL);
> +
> + if (!sk || !udp_sk(sk)->encap_type) {
> + rcu_read_unlock();
> + return FLOW_DISSECT_RET_OUT_GOOD;
> + }
> +
> + encap_type = udp_sk(sk)->encap_type;
> + rcu_read_unlock();
> +
> + break;
> + }
> +#endif /* CONFIG_IPV6 */
> + default:
> + return FLOW_DISSECT_RET_OUT_GOOD;
> + }
> +
> + nhoff = *p_nhoff + sizeof(struct udphdr);
maybe sizeof(_udph) for consistency
> + ret = FLOW_DISSECT_RET_OUT_GOOD;
> +
> + switch (encap_type) {
> + default:
> + break;
> + }
> +
> + switch (ret) {
> + case FLOW_DISSECT_RET_PROTO_AGAIN:
> + *p_ip_proto = 0;
> + fallthrough;
> + case FLOW_DISSECT_RET_IPPROTO_AGAIN:
> + *p_nhoff = nhoff;
> + break;
> + default:
> + break;
> + }
> +
> + return ret;
> +}
> +
Powered by blists - more mailing lists