netdev - Re: [PATCH bpf-next v2 1/5] netkit: Add option for scrubbing skb meta data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: 
 <172835343452.49945.13615267856776299352.git-patchwork-notify@kernel.org>
Date: Tue, 08 Oct 2024 02:10:34 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Daniel Borkmann <daniel@...earbox.net>
Cc: martin.lau@...ux.dev, razor@...ckwall.org, kuba@...nel.org,
 jrife@...gle.com, tangchen.1@...edance.com, bpf@...r.kernel.org,
 netdev@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 1/5] netkit: Add option for scrubbing skb meta
 data

Hello:

This series was applied to bpf/bpf-next.git (net)
by Martin KaFai Lau <martin.lau@...nel.org>:

On Fri,  4 Oct 2024 12:13:31 +0200 you wrote:
> Jordan reported that when running Cilium with netkit in per-endpoint-routes
> mode, network policy misclassifies traffic. In this direct routing mode
> of Cilium which is used in case of GKE/EKS/AKS, the Pod's BPF program to
> enforce policy sits on the netkit primary device's egress side.
> 
> The issue here is that in case of netkit's netkit_prep_forward(), it will
> clear meta data such as skb->mark and skb->priority before executing the
> BPF program. Thus, identity data stored in there from earlier BPF programs
> (e.g. from tcx ingress on the physical device) gets cleared instead of
> being made available for the primary's program to process. While for traffic
> egressing the Pod via the peer device this might be desired, this is
> different for the primary one where compared to tcx egress on the host
> veth this information would be available.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/5] netkit: Add option for scrubbing skb meta data
    https://git.kernel.org/bpf/bpf-next/c/83134ef46093
  - [bpf-next,v2,2/5] netkit: Simplify netkit mode over to use NLA_POLICY_MAX
    https://git.kernel.org/bpf/bpf-next/c/0ebe224ffce8
  - [bpf-next,v2,3/5] netkit: Add add netkit scrub support to rt_link.yaml
    https://git.kernel.org/bpf/bpf-next/c/7b9b713b8ef3
  - [bpf-next,v2,4/5] tools: Sync if_link.h uapi tooling header
    https://git.kernel.org/bpf/bpf-next/c/107525833bce
  - [bpf-next,v2,5/5] selftests/bpf: Extend netkit tests to validate skb meta data
    https://git.kernel.org/bpf/bpf-next/c/716fa7dadf11

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html