From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27A5DC43381 for ; Mon, 25 Feb 2019 16:52:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EC43120842 for ; Mon, 25 Feb 2019 16:52:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="a79SYjwW" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728340AbfBYQwh (ORCPT ); Mon, 25 Feb 2019 11:52:37 -0500 Received: from mail-pl1-f196.google.com ([209.85.214.196]:38020 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728272AbfBYQwh (ORCPT ); Mon, 25 Feb 2019 11:52:37 -0500 Received: by mail-pl1-f196.google.com with SMTP id g37so1954714plb.5 for ; Mon, 25 Feb 2019 08:52:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=7CWUq4HciKEFPlijmymkayr1MFqQrHEefsoza2tfOA4=; b=a79SYjwWBa35dJv69bKqsGjZ4OW20Ieq+XWBSgq+/8gAka6E5rNy887OgAEsKMnK6O +xG8KRG96EttDAHlm8PkjjNdbM3sY8FxMQ5ZlKwURb36n0T9Jhxdso1xJuVphC1+KA/9 XafCOyyPz+Ed1F+bSEfrCe1/sKr/f7CpnzbNRGO4WxwS4qr9bEesR7oTzHgyxpgiIk1j KUZl9kKavO5q6u3evgc1coi0UklJeXICy3KuKBvakQhdqQLjridD11aPRDdPPUxbBT/Z MEw0lih8b2npcmGmakSNCAJSDN1g4oH/QaiqcImEsZU+NgNgYfui2SqOY7SMNmru9Dky HMEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=7CWUq4HciKEFPlijmymkayr1MFqQrHEefsoza2tfOA4=; b=JgHDV9AeIhme4l6pZzjP51AUWe5a0txI9yWcpb6c6zPRK0Wna/lxPi2GtFw5DFPDq1 h43kUvXWWnDpWNj5sMI33YCRtlEc+7gPB5M8oItWEJsj0S9BxTaSVPICrHbfO92E9gm4 8G1xQ5mPp5+NmrJwBTeF9r7Hm7BWETV8AB8pFMt0peSBx17EQUtBCbLb8YtlsfZ47qFY z/SBPnhUu5RT8GdECd3GwLCiHma/RVaPQLRrWLQDznheaLfKMeF08xbP9zsa4Z4LiE6P INSXcw+GL2QYXCjCYqV5vS01jskdi7+9z5qhHB08B4v9MqRFkXMHFV3yfZcTg0XpKwVv 4+mQ== X-Gm-Message-State: AHQUAuam6zrhWQ1zX2bQcEdY5HF1qXSvMyiEx4OSaDWSdzkkSw3vNJRP e/6NjutlmQ3xKzkcsxUqbTQ= X-Google-Smtp-Source: AHgI3IZx+VGVv1nub/d23In8iEW1aytuT5DyaqieSCLIwHqE8wOW4Y43raJIXhLaoz8iKAu4q2A/6A== X-Received: by 2002:a17:902:ea06:: with SMTP id cu6mr21200160plb.187.1551113556769; Mon, 25 Feb 2019 08:52:36 -0800 (PST) Received: from ?IPv6:2620:15c:2c1:200:55c7:81e6:c7d8:94b? ([2620:15c:2c1:200:55c7:81e6:c7d8:94b]) by smtp.gmail.com with ESMTPSA id d26sm13106700pfn.86.2019.02.25.08.52.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Feb 2019 08:52:35 -0800 (PST) Subject: Re: [PATCH v2 bpf-next 4/9] bpf: add bpf helper bpf_skb_ecn_set_ce To: Daniel Borkmann , Martin Lau Cc: Lawrence Brakmo , netdev , Alexei Starovoitov , Kernel Team References: <20190223010703.678070-1-brakmo@fb.com> <20190223010703.678070-5-brakmo@fb.com> <20190223073031.utnow4seviqyfqta@kafai-mbp.dhcp.thefacebook.com> From: Eric Dumazet Message-ID: Date: Mon, 25 Feb 2019 08:52:35 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 02/25/2019 02:10 AM, Daniel Borkmann wrote: > My understanding is that before doing any writes into skb, we should make > sure the data area is private to us (and offset in linear data). In tc BPF > (ingress, egress) we use bpf_try_make_writable() helper for this, others > like act_{pedit,skbmod} or ovs have similar logic before writing into skb, > note that in all these cases it's mostly about generic writes, so location > could also be L4, for example. > > Difference of above helper compared to net/sched/sch_*.c instances could > be that it's i) for the qdisc case it's only on egress INET_ECN_set_ce() > and that there may be a convention that qdiscs specifically may mangle > it whereas the helper could be called on ingress and egress and confuse > other subsystems since they won't see original or race by seeing partially > updated (invalid) packet. > > Eric, have a chance to clarify? Perhaps then would make sense to disallow > the helper in cgroup ingress path. Good observations Daniel, thanks for bringing this up. skb_ensure_writable() seems a big hammer for the case we change some bits in IP header. TCP cloned packets certainly can have their headers mangled, so maybe we need to use something using skb_header_cloned() instead of skb_cloned()