netdev - Re: [PATCH net-next v2 00/12] flow_dissector: Dissect UDP encapsulation protocols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALx6S36og1_Q+zj5vY4xn4TzBJgHjHOiO6DjdtDVW5g+xEnujw@mail.gmail.com>
Date: Tue, 20 Aug 2024 11:28:02 -0700
From: Tom Herbert <tom@...bertland.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, edumazet@...gle.com, 
	netdev@...r.kernel.org, felipe@...anda.io
Subject: Re: [PATCH net-next v2 00/12] flow_dissector: Dissect UDP
 encapsulation protocols

On Fri, Aug 16, 2024 at 1:19 PM Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
>
> Tom Herbert wrote:
> > Add support in flow_dissector for dissecting into UDP
> > encapsulations like VXLAN. __skb_flow_dissect_udp is called for
> > IPPROTO_UDP. The flag FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS enables parsing
> > of UDP encapsulations. If the flag is set when parsing a UDP packet then
> > a socket lookup is performed. The offset of the base network header,
> > either an IPv4 or IPv6 header, is tracked and passed to
> > __skb_flow_dissect_udp so that it can perform the socket lookup.
> > If a socket is found and it's for a UDP encapsulation (encap_type is
> > set in the UDP socket) then a switch is performed on the encap_type
> > value (cases are UDP_ENCAP_* values)
> >
> > Changes in the patch set:
> >
> > - Unconstantify struct net argument in flowdis functions so we can call
> >   UDP socket lookup functions
> > - Dissect ETH_P_TEB in main flow dissector loop, move ETH_P_TEB check
> >   out of __skb_flow_dissect_gre and process it in main loop
> > - Add UDP_ENCAP constants for tipc, fou, gue, sctp, rxe, pfcp,
> >   wireguard, bareudp, vxlan, vxlan_gpe, geneve, and amt
> > - For the various UDP encapsulation protocols, Instead of just setting
> >   UDP tunnel encap type to 1, set it to the corresponding UDP_ENCAP
> >   constant. This allows identify the encapsulation protocol for a
> >   UDP socket by the encap_type
> > - Add function __skb_flow_dissect_udp in flow_dissector and call it for
> >   UDP packets. If a UDP encapsulation is present then the function
> >   returns either FLOW_DISSECT_RET_PROTO_AGAIN or
> >   FLOW_DISSECT_RET_IPPROTO_AGAIN
> > - Add flag FLOW_DISSECTOR_F_PARSE_UDP_ENCAPS that indicates UDP
> >   encapsulations should be dissected
> > - Add __skb_flow_dissect_vxlan which is called when encap_type is
> >   UDP_ENCAP_VXLAN or UDP_ENCAP_VXLAN_GPE. Dissect VXLAN and return
> >   a next protocol and offset
> > - Add __skb_flow_dissect_fou which is called when encap_type is
> >   UDP_ENCAP_FOU. Dissect FOU and return a next protocol and offset
> > - Add support for ESP, L2TP, and SCTP in UDP in __skb_flow_dissect_udp.
> >   All we need to do is return FLOW_DISSECT_RET_IPPROTO_AGAIN and the
> >   corresponding IP protocol number
> > - Add __skb_flow_dissect_geneve which is called when encap_type is
> >   UDP_ENCAP_GENEVE. Dissect geneve and return a next protocol and offset
> > - Add __skb_flow_dissect_gue which is called when encap_type is
> >   UDP_ENCAP_GUE. Dissect gue and return a next protocol and offset
> > - Add __skb_flow_dissect_gtp which is called when encap_type is
> >   UDP_ENCAP_GTP. Dissect gtp and return a next protocol and offset
> >
> > Tested: Verified fou, gue, vxlan, and geneve are properly dissected for
> > IPv4 and IPv6 cases. This includes testing ETH_P_TEB case
>
> On our conversation in v1 that this is manual:
>
> Would be really nice to have some test coverage for flow dissection.
> We only have this for BPF flow dissection. This seems like a suitable
> candidate for KUNIT. Like gso_test_func. Don't mean to put you on the
> spot per se to add this coverage.

Sure. We'll add a KUNIT test for flow dissector (it sorely needs that!)

Tom