netdev - [PATCH/RFC net-next] openvswitch: allow output of MPLS packets on tunnel vports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 16 Jun 2015 09:39:49 +0900
From:	Simon Horman <simon.horman@...ronome.com>
To:	Pravin Shelar <pshelar@...ira.com>
Cc:	netdev@...r.kernel.org, dev@...nvswitch.org,
	Simon Horman <simon.horman@...ronome.com>
Subject: [PATCH/RFC net-next] openvswitch: allow output of MPLS packets on tunnel vports

Currently output of MPLS packets on tunnel vports is not allowed by the
datapath and, moreover, flows that match on MPLS packets and output to
tunnel vports are rejected by the datapath. The flows are rejected
regardless of if they also output to non-tunnel vports which is allowed for
MPLS packets and the following is logged by the kernel.

openvswitch: netlink: Flow actions may not be safe on all matching packets.

This patch addresses the above by allowing output of MPLS packets to tunnel
vports.

My recollection of adding MPLS support to the datapath was that a rather
conservative approach was taken in order to minimise the chance of fallout.
This patch proposes relaxing one restriction which was introduced at that
time.

My limited testing has not isolated any side effects of this change.

Signed-off-by: Simon Horman <simon.horman@...ronome.com>
---
 net/openvswitch/flow_netlink.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 624e41c4267f..a5d3c0ae8ac8 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1847,9 +1847,6 @@ static int validate_set(const struct nlattr *a,
 		break;

 	case OVS_KEY_ATTR_TUNNEL:
-		if (eth_p_mpls(eth_type))
-			return -EINVAL;
-
 		if (masked)
 			return -EINVAL; /* Masked tunnel set not supported. */

-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html