netdev - Re: [ovs-dev] [PATCH net-next] ovs: allow nl 'flow set' to use ufid without flow key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 9 Mar 2016 13:35:03 -0800
From:	pravin shelar <pshelar@....org>
To:	Samuel Gauthier <samuel.gauthier@...nd.com>
Cc:	Pravin Shelar <pshelar@...ira.com>,
	"David S. Miller" <davem@...emloft.net>,
	ovs dev <dev@...nvswitch.org>,
	Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: [ovs-dev] [PATCH net-next] ovs: allow nl 'flow set' to use ufid
 without flow key

On Wed, Mar 9, 2016 at 9:05 AM, Samuel Gauthier
<samuel.gauthier@...nd.com> wrote:
> When we want to change a flow using netlink, we have to identify it to
> be able to perform a lookup. Both the flow key and unique flow ID
> (ufid) are valid identifiers, but we always have to specify the flow
> key in the netlink message. When both attributes are there, the ufid
> is used.
>
> This commit allows to use the ufid without having to provide the flow
> key, as it is already done in the netlink 'flow get' and 'flow del'
> path.
>
> Signed-off-by: Samuel Gauthier <samuel.gauthier@...nd.com>
> ---
>  net/openvswitch/datapath.c | 21 ++++++++++-----------
>  1 file changed, 10 insertions(+), 11 deletions(-)
>
> diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
> index deadfdab1bc3..06f15143cf2a 100644
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -1100,21 +1100,20 @@ static int ovs_flow_cmd_set(struct sk_buff *skb, struct genl_info *info)
>         struct sw_flow_match match;
>         struct sw_flow_id sfid;
>         u32 ufid_flags = ovs_nla_get_ufid_flags(a[OVS_FLOW_ATTR_UFID_FLAGS]);
> -       int error;
> +       int error = 0;
>         bool log = !a[OVS_FLOW_ATTR_PROBE];
>         bool ufid_present;
>
> -       /* Extract key. */
> -       error = -EINVAL;
> -       if (!a[OVS_FLOW_ATTR_KEY]) {
> -               OVS_NLERR(log, "Flow key attribute not present in set flow.");
> -               goto error;
> -       }
> -
>         ufid_present = ovs_nla_get_ufid(&sfid, a[OVS_FLOW_ATTR_UFID], log);
> -       ovs_match_init(&match, &key, &mask);
> -       error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
> -                                 a[OVS_FLOW_ATTR_MASK], log);
> +       if (a[OVS_FLOW_ATTR_KEY]) {
> +               ovs_match_init(&match, &key, NULL);
> +               error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
> +                                         NULL, log);
> +       } else if (!ufid_present) {
> +               OVS_NLERR(log,
> +                         "Flow set message rejected, Key attribute missing.");
> +               error = -EINVAL;
> +       }

Set command sets new action for given flow. The action validation
depends on the flow key and mask. so userspace needs to provide the
key and mask.