netdev - Re: [PATCH net-next v7] openvswitch: enable NSH support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 4 Sep 2017 15:16:01 +0200
From:   Jiri Benc <jbenc@...hat.com>
To:     Jan Scheurich <jan.scheurich@...csson.com>
Cc:     "Yang, Yi" <yi.y.yang@...el.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "dev@...nvswitch.org" <dev@...nvswitch.org>,
        "e@...g.me" <e@...g.me>, "blp@....org" <blp@....org>
Subject: Re: [PATCH net-next v7] openvswitch: enable NSH support

On Mon, 4 Sep 2017 12:57:15 +0000, Jan Scheurich wrote:
> So is what you are suggesting the following?
> 
> For matching:
> OVS_KEY_ATTR_NSH_BASE_HEADER		mandatory
> OVS_KEY_ATTR_NSH_MD1_CONTEXT		optional, in case MDTYPE == MD1

This needs to be:

OVS_KEY_ATTR_NSH
	OVS_KEY_ATTR_NSH_BASE_HEADER
	OVS_KEY_ATTR_NSH_MD1_CONTEXT

> For setting:
> OVS_ACTION_ATTR_SET_MASKED
> -    OVS_KEY_ATTR_NSH_BASE_HEADER		when setting any base header fields
> OVS_ACTION_ATTR_SET_MASKED
> -    OVS_KEY_ATTR_NSH_MD1_CONTEXT	when setting any MD1 context data fields

This needs to be:

OVS_ACTION_ATTR_SET_MASKED
	OVS_KEY_ATTR_NSH
		OVS_KEY_ATTR_NSH_BASE_HEADER
		OVS_KEY_ATTR_NSH_MD1_CONTEXT

In your example, there's no way to distinguish OVS_KEY_ATTR_ENCAP and
OVS_KEY_ATTR_NSH_BASE_HEADER, they are both "1".

> Should we consider to stick to that simple and efficient approach? As far 
> As I can see it will be generic for the foreseeable future.

I'm not sure. From the kernel point of view, we want the same
functionality offered by the openvswitch module and by a tc action.

In theory, it can be the tc tool that constructs the header from the
command line but there's no precedent. Dunno.

 Jiri