From: Pedro Tammela <pctammela@mojatatu.com>
To: Max Tottenham <mtottenh@akamai.com>, netdev@vger.kernel.org
Cc: Jamal Hadi Salim <jhs@mojatatu.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Jiri Pirko <jiri@resnulli.us>, Amir Vadai <amir@vadai.me>,
Josh Hunt <johunt@akamai.com>, kernel test robot <lkp@intel.com>
Subject: Re: [PATCH v2] net/sched: act_pedit: Parse L3 Header for L4 offset
Date: Fri, 26 May 2023 10:47:46 -0300 [thread overview]
Message-ID: <5587e78a-acfe-edfa-6b6b-c35bea34f5a3@mojatatu.com> (raw)
In-Reply-To: <20230526095810.280474-1-mtottenh@akamai.com>
On 26/05/2023 06:58, Max Tottenham wrote:
> Instead of relying on skb->transport_header being set correctly, opt
> instead to parse the L3 header length out of the L3 headers for both
> IPv4/IPv6 when the Extended Layer Op for tcp/udp is used. This fixes a
> bug if GRO is disabled, when GRO is disabled skb->transport_header is
> set by __netif_receive_skb_core() to point to the L3 header, it's later
> fixed by the upper protocol layers, but act_pedit will receive the SKB
> before the fixups are completed. The existing behavior causes the
> following to edit the L3 header if GRO is disabled instead of the UDP
> header:
>
> tc filter add dev eth0 ingress protocol ip flower ip_proto udp \
> dst_ip 192.168.1.3 action pedit ex munge udp set dport 18053
>
> Also re-introduce a rate-limited warning if we were unable to extract
> the header offset when using the 'ex' interface.
>
> Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to
> the conventional network headers")
Just a FYI: the automatic back port will probably fail because of a
recent cleanup in this code
> Signed-off-by: Max Tottenham <mtottenh@akamai.com>
> Reviewed-by: Josh Hunt <johunt@akamai.com>
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202305261541.N165u9TZ-lkp@intel.com/
> ---
> V1 -> V2:
> * Fix minor bug reported by kernel test bot.
>
> ---
> net/sched/act_pedit.c | 48 ++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 43 insertions(+), 5 deletions(-)
>
> diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
> index fc945c7e4123..d28335519459 100644
> --- a/net/sched/act_pedit.c
> +++ b/net/sched/act_pedit.c
> @@ -13,7 +13,10 @@
> #include <linux/rtnetlink.h>
> #include <linux/module.h>
> #include <linux/init.h>
> +#include <linux/ip.h>
> +#include <linux/ipv6.h>
> #include <linux/slab.h>
> +#include <net/ipv6.h>
> #include <net/netlink.h>
> #include <net/pkt_sched.h>
> #include <linux/tc_act/tc_pedit.h>
> @@ -327,28 +330,58 @@ static bool offset_valid(struct sk_buff *skb, int offset)
> return true;
> }
>
> -static void pedit_skb_hdr_offset(struct sk_buff *skb,
> +static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int header_type)
> +{
> + int noff = skb_network_offset(skb);
> + struct iphdr *iph = NULL;
> + int ret = -EINVAL;
nit: Should be in reverse Christmas tree
> +
> + switch (skb->protocol) {
> + case htons(ETH_P_IP):
> + if (!pskb_may_pull(skb, sizeof(*iph) + noff))
> + goto out;
I might have missed something but is this really needed?
https://elixir.bootlin.com/linux/latest/source/net/ipv4/ip_input.c#L456
> + iph = ip_hdr(skb);
> + *hoffset = noff + iph->ihl * > + ret = 0;
> + break;
> + case htons(ETH_P_IPV6):
> + *hoffset = 0;
nit: Not needed
> + ret = ipv6_find_hdr(skb, hoffset, header_type, NULL, NULL) == header_type ? 0 : -EINVAL;
> + break;
> + }
> +out:
> + return ret;
> +}
> +
> +static int pedit_skb_hdr_offset(struct sk_buff *skb,
> enum pedit_header_type htype, int *hoffset)
> {
> + int ret = -EINVAL;
> /* 'htype' is validated in the netlink parsing */
> switch (htype) {
> case TCA_PEDIT_KEY_EX_HDR_TYPE_ETH:
> - if (skb_mac_header_was_set(skb))
> + if (skb_mac_header_was_set(skb)) {
> *hoffset = skb_mac_offset(skb);
> + ret = 0;
> + }
> break;
> case TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK:
> case TCA_PEDIT_KEY_EX_HDR_TYPE_IP4:
> case TCA_PEDIT_KEY_EX_HDR_TYPE_IP6:
> *hoffset = skb_network_offset(skb);
> + ret = 0;
> break;
> case TCA_PEDIT_KEY_EX_HDR_TYPE_TCP:
> + ret = pedit_l4_skb_offset(skb, hoffset, IPPROTO_TCP);
> + break;
> case TCA_PEDIT_KEY_EX_HDR_TYPE_UDP:
> - if (skb_transport_header_was_set(skb))
> - *hoffset = skb_transport_offset(skb);
> + ret = pedit_l4_skb_offset(skb, hoffset, IPPROTO_UDP);
> break;
> default:
> + ret = -EINVAL;
nit: Not needed
> break;
> }
> + return ret;
> }
>
> TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
> @@ -384,6 +417,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
> int hoffset = 0;
> u32 *ptr, hdata;
> u32 val;
> + int rc;
>
> if (tkey_ex) {
> htype = tkey_ex->htype;
> @@ -392,7 +426,11 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
> tkey_ex++;
> }
>
> - pedit_skb_hdr_offset(skb, htype, &hoffset);
> + rc = pedit_skb_hdr_offset(skb, htype, &hoffset);
> + if (rc) {
> + pr_info_ratelimited("tc action pedit unable to extract header offset for header type (0x%x)\n", htype);
> + goto bad;
> + }
>
> if (tkey->offmask) {
> u8 *d, _d;
next prev parent reply other threads:[~2023-05-26 13:47 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-26 9:58 [PATCH v2] net/sched: act_pedit: Parse L3 Header for L4 offset Max Tottenham
2023-05-26 13:47 ` Pedro Tammela [this message]
2023-05-26 13:52 ` Pedro Tammela
2023-05-26 14:03 ` Pedro Tammela
2023-05-26 21:54 ` Josh Hunt
2023-05-27 15:44 ` Pedro Tammela
2023-06-07 10:59 ` Max Tottenham
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5587e78a-acfe-edfa-6b6b-c35bea34f5a3@mojatatu.com \
--to=pctammela@mojatatu.com \
--cc=amir@vadai.me \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=johunt@akamai.com \
--cc=lkp@intel.com \
--cc=mtottenh@akamai.com \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).