svn commit: r366532 - in head: share/man/man4 sys/dev/cxgbe
Navdeep Parhar
np at FreeBSD.org
Thu Oct 8 10:00:14 UTC 2020
Author: np
Date: Thu Oct 8 10:00:13 2020
New Revision: 366532
URL: https://svnweb.freebsd.org/changeset/base/366532
Log:
cxgbe(4): knobs to drop various kinds of undesirable frames on ingress.
These kind of drops come for free in the sense that they do not use the
filter TCAM or any other resource that wouldn't normally be used during
rx. Frames dropped by the hardware get counted in the MAC's rx stats
but are not delivered to the driver.
hw.cxgbe.attack_filter
Set to 1 to enable the "attack filter". Default is 0. The attack
filter will drop an incoming frame if any of these conditions is true:
src ip/ip6 == dst ip/ip6; tcp and src/dst ip is not unicast; src/dst ip
is loopback (127.x.y.z); src ip6 is not unicast; src/dst ip6 is loopback
(::1/128) or unspecified (::/128); tcp and src/dst ip6 is mcast
(ff00::/8).
hw.cxgbe.drop_ip_fragments
Set to 1 to drop all incoming IP fragments. Default is 0. Note that
this drops valid frames.
hw.cxgbe.drop_pkts_with_l2_errors
Set to 1 to drop incoming frames with Layer 2 length or checksum errors.
Default is 1.
hw.cxgbe.drop_pkts_with_l3_errors
Set to 1 to drop incoming frames with IP version, length, or checksum
errors. Default is 0.
hw.cxgbe.drop_pkts_with_l4_errors
Set to 1 to drop incoming frames with Layer 4 length, checksum, or other
errors. Default is 0.
MFC after: 2 weeks
Sponsored by: Chelsio Communications
Modified:
head/share/man/man4/cxgbe.4
head/sys/dev/cxgbe/t4_main.c
Modified: head/share/man/man4/cxgbe.4
==============================================================================
--- head/share/man/man4/cxgbe.4 Thu Oct 8 04:00:31 2020 (r366531)
+++ head/share/man/man4/cxgbe.4 Thu Oct 8 10:00:13 2020 (r366532)
@@ -31,7 +31,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd September 17, 2020
+.Dd October 8, 2020
.Dt CXGBE 4
.Os
.Sh NAME
@@ -362,6 +362,26 @@ The default value is 0 and should be changed only if P
to communicate with each other.
Different interfaces can be assigned different values using the
dev.<port>.X.tx_vm_wr sysctl when the interface is administratively down.
+.It Va hw.cxgbe.attack_filter
+Set to 1 to enable the "attack filter".
+Default is 0.
+The attack filter will drop an incoming frame if any of these conditions is
+true: src ip/ip6 == dst ip/ip6; tcp and src/dst ip is not unicast; src/dst ip is
+loopback (127.x.y.z); src ip6 is not unicast; src/dst ip6 is loopback (::1/128)
+or unspecified (::/128); tcp and src/dst ip6 is mcast (ff00::/8).
+.It Va hw.cxgbe.drop_ip_fragments
+Set to 1 to drop all incoming IP fragments.
+Default is 0.
+Note that this drops valid frames.
+.It Va hw.cxgbe.drop_pkts_with_l2_errors
+Set to 1 to drop incoming frames with Layer 2 length or checksum errors.
+Default is 1.
+.It Va hw.cxgbe.drop_pkts_with_l3_errors
+Set to 1 to drop incoming frames with IP version, length, or checksum errors.
+Default is 0.
+.It Va hw.cxgbe.drop_pkts_with_l4_errors
+Set to 1 to drop incoming frames with Layer 4 length, checksum, or other errors.
+Default is 0.
.El
.Sh SUPPORT
For general information and support,
Modified: head/sys/dev/cxgbe/t4_main.c
==============================================================================
--- head/sys/dev/cxgbe/t4_main.c Thu Oct 8 04:00:31 2020 (r366531)
+++ head/sys/dev/cxgbe/t4_main.c Thu Oct 8 10:00:13 2020 (r366532)
@@ -595,6 +595,46 @@ static int t4_tx_vm_wr = 0;
SYSCTL_INT(_hw_cxgbe, OID_AUTO, tx_vm_wr, CTLFLAG_RWTUN, &t4_tx_vm_wr, 0,
"Use VM work requests to transmit packets.");
+/*
+ * Set to non-zero to enable the attack filter. A packet that matches any of
+ * these conditions will get dropped on ingress:
+ * 1) IP && source address == destination address.
+ * 2) TCP/IP && source address is not a unicast address.
+ * 3) TCP/IP && destination address is not a unicast address.
+ * 4) IP && source address is loopback (127.x.y.z).
+ * 5) IP && destination address is loopback (127.x.y.z).
+ * 6) IPv6 && source address == destination address.
+ * 7) IPv6 && source address is not a unicast address.
+ * 8) IPv6 && source address is loopback (::1/128).
+ * 9) IPv6 && destination address is loopback (::1/128).
+ * 10) IPv6 && source address is unspecified (::/128).
+ * 11) IPv6 && destination address is unspecified (::/128).
+ * 12) TCP/IPv6 && source address is multicast (ff00::/8).
+ * 13) TCP/IPv6 && destination address is multicast (ff00::/8).
+ */
+static int t4_attack_filter = 0;
+SYSCTL_INT(_hw_cxgbe, OID_AUTO, attack_filter, CTLFLAG_RDTUN,
+ &t4_attack_filter, 0, "Drop suspicious traffic");
+
+static int t4_drop_ip_fragments = 0;
+SYSCTL_INT(_hw_cxgbe, OID_AUTO, drop_ip_fragments, CTLFLAG_RDTUN,
+ &t4_drop_ip_fragments, 0, "Drop IP fragments");
+
+static int t4_drop_pkts_with_l2_errors = 1;
+SYSCTL_INT(_hw_cxgbe, OID_AUTO, drop_pkts_with_l2_errors, CTLFLAG_RDTUN,
+ &t4_drop_pkts_with_l2_errors, 0,
+ "Drop all frames with Layer 2 length or checksum errors");
+
+static int t4_drop_pkts_with_l3_errors = 0;
+SYSCTL_INT(_hw_cxgbe, OID_AUTO, drop_pkts_with_l3_errors, CTLFLAG_RDTUN,
+ &t4_drop_pkts_with_l3_errors, 0,
+ "Drop all frames with IP version, length, or checksum errors");
+
+static int t4_drop_pkts_with_l4_errors = 0;
+SYSCTL_INT(_hw_cxgbe, OID_AUTO, drop_pkts_with_l4_errors, CTLFLAG_RDTUN,
+ &t4_drop_pkts_with_l4_errors, 0,
+ "Drop all frames with Layer 4 length, checksum, or other errors");
+
#ifdef TCP_OFFLOAD
/*
* TOE tunables.
@@ -4740,7 +4780,7 @@ t4_enable_kern_tls(struct adapter *sc)
static int
set_params__post_init(struct adapter *sc)
{
- uint32_t param, val;
+ uint32_t mask, param, val;
#ifdef TCP_OFFLOAD
int i, v, shift;
#endif
@@ -4760,6 +4800,33 @@ set_params__post_init(struct adapter *sc)
val = 1 << (G_MASKSIZE(t4_read_reg(sc, A_TP_RSS_CONFIG_TNL)) - 1);
t4_set_reg_field(sc, A_TP_RSS_CONFIG_TNL, V_MASKFILTER(M_MASKFILTER),
V_MASKFILTER(val - 1));
+
+ mask = F_DROPERRORANY | F_DROPERRORMAC | F_DROPERRORIPVER |
+ F_DROPERRORFRAG | F_DROPERRORATTACK | F_DROPERRORETHHDRLEN |
+ F_DROPERRORIPHDRLEN | F_DROPERRORTCPHDRLEN | F_DROPERRORPKTLEN |
+ F_DROPERRORTCPOPT | F_DROPERRORCSUMIP | F_DROPERRORCSUM;
+ val = 0;
+ if (t4_attack_filter != 0) {
+ t4_set_reg_field(sc, A_TP_GLOBAL_CONFIG, F_ATTACKFILTERENABLE,
+ F_ATTACKFILTERENABLE);
+ val |= F_DROPERRORATTACK;
+ }
+ if (t4_drop_ip_fragments != 0) {
+ t4_set_reg_field(sc, A_TP_GLOBAL_CONFIG, F_FRAGMENTDROP,
+ F_FRAGMENTDROP);
+ val |= F_DROPERRORFRAG;
+ }
+ if (t4_drop_pkts_with_l2_errors != 0)
+ val |= F_DROPERRORMAC | F_DROPERRORETHHDRLEN;
+ if (t4_drop_pkts_with_l3_errors != 0) {
+ val |= F_DROPERRORIPVER | F_DROPERRORIPHDRLEN |
+ F_DROPERRORCSUMIP;
+ }
+ if (t4_drop_pkts_with_l4_errors != 0) {
+ val |= F_DROPERRORTCPHDRLEN | F_DROPERRORPKTLEN |
+ F_DROPERRORTCPOPT | F_DROPERRORCSUM;
+ }
+ t4_set_reg_field(sc, A_TP_ERR_CONFIG, mask, val);
#ifdef TCP_OFFLOAD
/*
More information about the svn-src-all
mailing list