From patchwork Tue Jun 15 00:10:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tanner Love X-Patchwork-Id: 460119 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBCABC48BE6 for ; Tue, 15 Jun 2021 00:11:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C4D73610F7 for ; Tue, 15 Jun 2021 00:11:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230247AbhFOANZ (ORCPT ); Mon, 14 Jun 2021 20:13:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229536AbhFOANX (ORCPT ); Mon, 14 Jun 2021 20:13:23 -0400 Received: from mail-qv1-xf2b.google.com (mail-qv1-xf2b.google.com [IPv6:2607:f8b0:4864:20::f2b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F33B2C061574 for ; Mon, 14 Jun 2021 17:11:04 -0700 (PDT) Received: by mail-qv1-xf2b.google.com with SMTP id 5so11154962qvf.1 for ; Mon, 14 Jun 2021 17:11:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=kjFoSGDDyYzYZW5mh9Jyks0pSyoHbJXZIOLbiyAvgAo=; b=VceFz1WhCRsKKkM8DFbd6FyVM9buxc8XNmTgBKrZuPPuG9RDQ9RKve/efHLh5nHB96 YLhJUx7XIvXPge8M04nJUfY9xmuQXGnJm0cy6QMviL1M3zxWieWiG4/U0ic47kSJu8HX ORMDv3QkMJVa2y+xl+k3mJ2xxeCr5ik4a5SjEGLqWqgZ/G6uywg3mcsyj56dfvmD+lnn OoXeumjC/uttjGTXJmyprcPm0u7DqMyoGD28w8+fFiS5DkTj7MLepZ8PUXFAPXy1pc7x HkXf7lA8JaBmRvWAL+OdH8pmzxu9/iQdp6j7Bv+SeuRtRjrHe6Vl+df/MN3fHqLHV38v XGdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=kjFoSGDDyYzYZW5mh9Jyks0pSyoHbJXZIOLbiyAvgAo=; b=tEkxfYseQWaKR5beuu2iGxm5LEGxWRC6rmGG80b6K7QztKmzgtzoCioNwjv9t1JwpV zOLPx0K5iYNU+Vtm4gAIIrHK5qGre8W6amAeXbCD34XBh8E78eB/8cVNAKWHMQmK/wcQ T+ecjdXbXfpFjHnNYmaDDGS0hKhZ67verjo/5g9WETRgPV/TP8KifUqP+sdEsWJfuR0o F1bAA1j6D/4xDbzZDeYgk14Ba+lSg/nMnohG6jukqDQNVRzYCdXCJCa//ipfdUvFnYl8 TDHgUzc2IXDKTDeWO05qXneLXyNp4MNNU/FyS1w+gwtuzuea76Fh2wsbTPyZeTATjiBm 2A5A== X-Gm-Message-State: AOAM530rh9E1DoWLZA6Hl88kI7NZOACS60sKAYnlJhzlzG8ECRvUu2jI qESHtQbVG6Obb6qy5dicXnU2Y4P7v30= X-Google-Smtp-Source: ABdhPJz61Sb3AyztOTNF7RtRL+Jx12TvSSE0j8OacLUdeluFlUBFTXah9+oPPZVtyrgN5vugBa9N5g== X-Received: by 2002:a0c:e387:: with SMTP id a7mr2001606qvl.36.1623715864034; Mon, 14 Jun 2021 17:11:04 -0700 (PDT) Received: from tannerlove.nyc.corp.google.com ([2620:0:1003:1000:592b:4d3c:3a31:b1fe]) by smtp.gmail.com with ESMTPSA id e1sm11153087qti.27.2021.06.14.17.11.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 14 Jun 2021 17:11:03 -0700 (PDT) From: Tanner Love To: netdev@vger.kernel.org Cc: davem@davemloft.net, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eric Dumazet , Willem de Bruijn , Petar Penkov , Jakub Kicinski , "Michael S . Tsirkin" , Jason Wang , Martin KaFai Lau , Tanner Love Subject: [PATCH net-next v6 0/3] virtio_net: add optional flow dissection in virtio_net_hdr_to_skb Date: Mon, 14 Jun 2021 20:10:57 -0400 Message-Id: <20210615001100.1008325-1-tannerlove.kernel@gmail.com> X-Mailer: git-send-email 2.32.0.272.g935e593368-goog MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Tanner Love First patch extends the flow dissector BPF program type to accept pointer to virtio-net header. Second patch uses this feature to add optional flow dissection in virtio_net_hdr_to_skb(). This allows admins to define permitted packets more strictly, for example dropping deprecated UDP_UFO packets. Third patch extends kselftest to cover this feature. Tanner Love (3): net: flow_dissector: extend bpf flow dissector support with vnet hdr virtio_net: add optional flow dissection in virtio_net_hdr_to_skb selftests/net: amend bpf flow dissector prog to do vnet hdr validation drivers/net/bonding/bond_main.c | 2 +- include/linux/bpf.h | 3 + include/linux/skbuff.h | 35 ++- include/linux/virtio_net.h | 25 ++- include/uapi/linux/bpf.h | 2 + kernel/bpf/verifier.c | 35 +-- net/bpf/test_run.c | 2 +- net/core/filter.c | 56 +++++ net/core/flow_dissector.c | 21 +- net/core/sysctl_net_core.c | 9 + tools/include/uapi/linux/bpf.h | 2 + tools/testing/selftests/bpf/progs/bpf_flow.c | 209 ++++++++++++++---- .../selftests/bpf/test_flow_dissector.c | 181 +++++++++++++-- .../selftests/bpf/test_flow_dissector.sh | 19 ++ 14 files changed, 502 insertions(+), 99 deletions(-)