From: Eyal Birger <firstname.lastname@example.org> To: Jesper Dangaard Brouer <email@example.com> Cc: "Daniel Borkmann" <firstname.lastname@example.org>, "Lorenz Bauer" <email@example.com>, "Maciej Żenczykowski" <firstname.lastname@example.org>, "Saeed Mahameed" <email@example.com>, "Daniel Borkmann" <firstname.lastname@example.org>, "Alexei Starovoitov" <email@example.com>, BPF-dev-list <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "Lorenzo Bianconi" <email@example.com>, "John Fastabend" <firstname.lastname@example.org>, "Jakub Kicinski" <email@example.com>, "Shaun Crampton" <firstname.lastname@example.org>, "David Miller" <email@example.com>, "Marek Majkowski" <firstname.lastname@example.org> Subject: Re: BPF redirect API design issue for BPF-prog MTU feedback? Date: Tue, 22 Sep 2020 09:56:05 +0300 Message-ID: <CAHsH6Gug-hsLGHQ6N0wtixdOa85LDZ3HNRHVd0opR=19Qo4W4Q@mail.gmail.com> (raw) In-Reply-To: <20200921182638.5d8343fd@carbon> On Mon, Sep 21, 2020 at 7:30 PM Jesper Dangaard Brouer <email@example.com> wrote: > > On Mon, 21 Sep 2020 17:08:17 +0200 > Daniel Borkmann <firstname.lastname@example.org> wrote: > > > On 9/21/20 2:49 PM, Jesper Dangaard Brouer wrote: > > > On Mon, 21 Sep 2020 11:37:18 +0100 > > > Lorenz Bauer <email@example.com> wrote: > > >> On Sat, 19 Sep 2020 at 00:06, Maciej Żenczykowski <firstname.lastname@example.org> wrote: > > >>> > > >>>> This is a good point. As bpf_skb_adjust_room() can just be run after > > >>>> bpf_redirect() call, then a MTU check in bpf_redirect() actually > > >>>> doesn't make much sense. As clever/bad BPF program can then avoid the > > >>>> MTU check anyhow. This basically means that we have to do the MTU > > >>>> check (again) on kernel side anyhow to catch such clever/bad BPF > > >>>> programs. (And I don't like wasting cycles on doing the same check two > > >>>> times). > > >>> > > >>> If you get rid of the check in bpf_redirect() you might as well get > > >>> rid of *all* the checks for excessive mtu in all the helpers that > > >>> adjust packet size one way or another way. They *all* then become > > >>> useless overhead. > > >>> > > >>> I don't like that. There may be something the bpf program could do to > > >>> react to the error condition (for example in my case, not modify > > >>> things and just let the core stack deal with things - which will > > >>> probably just generate packet too big icmp error). > > >>> > > >>> btw. right now our forwarding programs first adjust the packet size > > >>> then call bpf_redirect() and almost immediately return what it > > >>> returned. > > >>> > > >>> but this could I think easily be changed to reverse the ordering, so > > >>> we wouldn't increase packet size before the core stack was informed we > > >>> would be forwarding via a different interface. > > >> > > >> We do the same, except that we also use XDP_TX when appropriate. This > > >> complicates the matter, because there is no helper call we could > > >> return an error from. > > > > > > Do notice that my MTU work is focused on TC-BPF. For XDP-redirect the > > > MTU check is done in xdp_ok_fwd_dev() via __xdp_enqueue(), which also > > > happens too late to give BPF-prog knowledge/feedback. For XDP_TX I > > > audited the drivers when I implemented xdp_buff.frame_sz, and they > > > handled (or I added) handling against max HW MTU. E.g. mlx5 . > > > > > >  https://elixir.bootlin.com/linux/v5.9-rc6/source/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c#L267 > > > > > >> My preference would be to have three helpers: get MTU for a device, > > >> redirect ctx to a device (with MTU check), resize ctx (without MTU > > >> check) but that doesn't work with XDP_TX. Your idea of doing checks > > >> in redirect and adjust_room is pragmatic and seems easier to > > >> implement. > > > > > > I do like this plan/proposal (with 3 helpers), but it is not possible > > > with current API. The main problem is the current bpf_redirect API > > > doesn't provide the ctx, so we cannot do the check in the BPF-helper. > > > > > > Are you saying we should create a new bpf_redirect API (that incl packet ctx)? > > > > Sorry for jumping in late here... one thing that is not clear to me > > is that if we are fully sure that skb is dropped by stack anyway due > > to invalid MTU (redirect to ingress does this via dev_forward_skb(), > > Yes, TC-redirecting to *INGRESS* have a slightly relaxed MTU check via > is_skb_forwardable() called via ____dev_forward_skb(). This MTU check > seems redundant as netstack will do MTU checks anyhow. > I found the MTU check on redirect-to-ingress to be very unexpected. We hit this when implementing NAT64 as a tc egress program which translates the packet and redirects it to ingress from the same device. It is beneficial to have the MTU of the device set to a limit fitting the IPv4 MTU, so that the IP stack would fragment as needed on the IPv4->IPv6 path. But when translating the packet to IPv6, it can no longer be ingressed from the same device because of the MTU check. Packets are silently dropped without any hint. So would definitely be nice if this check is removed, or a flag to avoid it is supported in bpf_redirect(). Eyal.
next prev parent reply index Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-17 12:38 Jesper Dangaard Brouer 2020-09-17 12:54 ` Maciej Żenczykowski 2020-09-17 19:11 ` Saeed Mahameed 2020-09-18 10:00 ` Jesper Dangaard Brouer 2020-09-18 10:34 ` Toke Høiland-Jørgensen 2020-09-18 23:06 ` Maciej Żenczykowski 2020-09-21 10:37 ` Lorenz Bauer 2020-09-21 12:49 ` Jesper Dangaard Brouer 2020-09-21 15:08 ` Daniel Borkmann 2020-09-21 16:21 ` Marek Zavodsky 2020-09-21 21:17 ` Willem de Bruijn 2020-09-22 9:15 ` Jesper Dangaard Brouer 2020-09-21 16:26 ` Jesper Dangaard Brouer 2020-09-22 6:56 ` Eyal Birger [this message] 2020-09-21 18:04 ` John Fastabend 2020-10-06 11:45 ` Jesper Dangaard Brouer 2020-09-21 10:42 ` Lorenz Bauer
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAHsH6Gug-hsLGHQ6N0wtixdOa85LDZ3HNRHVd0opR=19Qo4W4Q@mail.gmail.com' \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Netdev Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \ email@example.com public-inbox-index netdev Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.netdev AGPL code for this site: git clone https://public-inbox.org/public-inbox.git