netdev - Re: [PATCH v3 net-next 1/2] udp_tunnel: create a fastpath GRO lookup.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <67d0730b8bee7_2fa72c29418@willemb.c.googlers.com.notmuch>
Date: Tue, 11 Mar 2025 13:29:47 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Paolo Abeni <pabeni@...hat.com>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 netdev@...r.kernel.org
Cc: "David S. Miller" <davem@...emloft.net>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Simon Horman <horms@...nel.org>, 
 David Ahern <dsahern@...nel.org>, 
 kuniyu@...zon.com
Subject: Re: [PATCH v3 net-next 1/2] udp_tunnel: create a fastpath GRO lookup.

Paolo Abeni wrote:
> On 3/11/25 3:32 AM, Willem de Bruijn wrote:
> > Paolo Abeni wrote:
> >> Most UDP tunnels bind a socket to a local port, with ANY address, no
> >> peer and no interface index specified.
> >> Additionally it's quite common to have a single tunnel device per
> >> namespace.
> >>
> >> Track in each namespace the UDP tunnel socket respecting the above.
> >> When only a single one is present, store a reference in the netns.
> >>
> >> When such reference is not NULL, UDP tunnel GRO lookup just need to
> >> match the incoming packet destination port vs the socket local port.
> >>
> >> The tunnel socket never sets the reuse[port] flag[s]. When bound to no
> >> address and interface, no other socket can exist in the same netns
> >> matching the specified local port.
> > 
> > What about packets with a non-local daddr (e.g., forwarding)?
> 
> I'm unsure if I understand the question. Such incoming packets at the
> GRO stage will match the given tunnel socket, either by full socket
> lookup or by dport only selection.
> 
> If the GSO packet will be forwarded, it will segmented an xmit time.
> 
> Possibly you mean something entirely different?!?

Thanks, no that is exactly what I meant:

Is a false positive possible? So answer is yes.

Is it safe. So, yes again, as further down the stack it just handles
the GSO packet correctly.

Would you mind adding that to commit message explicitly, since you're
respinning anyway?