netdev - Re: [PATCH net-next v2 00/12] flow_dissector: Dissect UDP encapsulation protocols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66bfb4665f930_189fc82943f@willemb.c.googlers.com.notmuch>
Date: Fri, 16 Aug 2024 16:19:50 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Tom Herbert <tom@...bertland.com>, 
 davem@...emloft.net, 
 kuba@...nel.org, 
 edumazet@...gle.com, 
 netdev@...r.kernel.org, 
 felipe@...anda.io, 
 willemdebruijn.kernel@...il.com
Cc: Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH net-next v2 00/12] flow_dissector: Dissect UDP
 encapsulation protocols

Tom Herbert wrote:
> Add support in flow_dissector for dissecting into UDP
> encapsulations like VXLAN. __skb_flow_dissect_udp is called for
> IPPROTO_UDP. The flag FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS enables parsing
> of UDP encapsulations. If the flag is set when parsing a UDP packet then
> a socket lookup is performed. The offset of the base network header,
> either an IPv4 or IPv6 header, is tracked and passed to
> __skb_flow_dissect_udp so that it can perform the socket lookup.
> If a socket is found and it's for a UDP encapsulation (encap_type is
> set in the UDP socket) then a switch is performed on the encap_type
> value (cases are UDP_ENCAP_* values)
> 
> Changes in the patch set:
> 
> - Unconstantify struct net argument in flowdis functions so we can call
>   UDP socket lookup functions
> - Dissect ETH_P_TEB in main flow dissector loop, move ETH_P_TEB check
>   out of __skb_flow_dissect_gre and process it in main loop
> - Add UDP_ENCAP constants for tipc, fou, gue, sctp, rxe, pfcp,
>   wireguard, bareudp, vxlan, vxlan_gpe, geneve, and amt
> - For the various UDP encapsulation protocols, Instead of just setting
>   UDP tunnel encap type to 1, set it to the corresponding UDP_ENCAP
>   constant. This allows identify the encapsulation protocol for a
>   UDP socket by the encap_type
> - Add function __skb_flow_dissect_udp in flow_dissector and call it for
>   UDP packets. If a UDP encapsulation is present then the function
>   returns either FLOW_DISSECT_RET_PROTO_AGAIN or
>   FLOW_DISSECT_RET_IPPROTO_AGAIN
> - Add flag FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS that indicates UDP
>   encapsulations should be dissected
> - Add __skb_flow_dissect_vxlan which is called when encap_type is
>   UDP_ENCAP_VXLAN or UDP_ENCAP_VXLAN_GPE. Dissect VXLAN and return
>   a next protocol and offset
> - Add __skb_flow_dissect_fou which is called when encap_type is
>   UDP_ENCAP_FOU. Dissect FOU and return a next protocol and offset
> - Add support for ESP, L2TP, and SCTP in UDP in __skb_flow_dissect_udp.
>   All we need to do is return FLOW_DISSECT_RET_IPPROTO_AGAIN and the
>   corresponding IP protocol number
> - Add __skb_flow_dissect_geneve which is called when encap_type is
>   UDP_ENCAP_GENEVE. Dissect geneve and return a next protocol and offset
> - Add __skb_flow_dissect_gue which is called when encap_type is
>   UDP_ENCAP_GUE. Dissect gue and return a next protocol and offset
> - Add __skb_flow_dissect_gtp which is called when encap_type is
>   UDP_ENCAP_GTP. Dissect gtp and return a next protocol and offset
> 
> Tested: Verified fou, gue, vxlan, and geneve are properly dissected for
> IPv4 and IPv6 cases. This includes testing ETH_P_TEB case

On our conversation in v1 that this is manual:

Would be really nice to have some test coverage for flow dissection.
We only have this for BPF flow dissection. This seems like a suitable
candidate for KUNIT. Like gso_test_func. Don't mean to put you on the
spot per se to add this coverage.