netdev - Re: [PATCH net-next v3 1/2] openvswitch: Add conntrack limit netlink definition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 2 May 2018 23:49:51 -0700
From:   Pravin Shelar <pshelar@....org>
To:     Yi-Hung Wei <yihung.wei@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next v3 1/2] openvswitch: Add conntrack limit netlink definition

On Mon, Apr 30, 2018 at 2:28 PM, Yi-Hung Wei <yihung.wei@...il.com> wrote:
> Define netlink messages and attributes to support user kernel
> communication that uses the conntrack limit feature.
>
> Signed-off-by: Yi-Hung Wei <yihung.wei@...il.com>
> ---
>  include/uapi/linux/openvswitch.h | 62 ++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 62 insertions(+)
>
> diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> index 713e56ce681f..ca63c16375ce 100644
> --- a/include/uapi/linux/openvswitch.h
> +++ b/include/uapi/linux/openvswitch.h
> @@ -937,4 +937,66 @@ enum ovs_meter_band_type {
>
>  #define OVS_METER_BAND_TYPE_MAX (__OVS_METER_BAND_TYPE_MAX - 1)
>
> +/* Conntrack limit */
> +#define OVS_CT_LIMIT_FAMILY  "ovs_ct_limit"
> +#define OVS_CT_LIMIT_MCGROUP "ovs_ct_limit"
> +#define OVS_CT_LIMIT_VERSION 0x1
> +
> +enum ovs_ct_limit_cmd {
> +       OVS_CT_LIMIT_CMD_UNSPEC,
> +       OVS_CT_LIMIT_CMD_SET,           /* Add or modify ct limit. */
> +       OVS_CT_LIMIT_CMD_DEL,           /* Delete ct limit. */
> +       OVS_CT_LIMIT_CMD_GET            /* Get ct limit. */
> +};
> +
> +enum ovs_ct_limit_attr {
> +       OVS_CT_LIMIT_ATTR_UNSPEC,
> +       OVS_CT_LIMIT_ATTR_OPTION,       /* Nested OVS_CT_LIMIT_ATTR_* */
> +       __OVS_CT_LIMIT_ATTR_MAX
> +};
> +
> +#define OVS_CT_LIMIT_ATTR_MAX (__OVS_CT_LIMIT_ATTR_MAX - 1)
> +
> +/**
> + * @OVS_CT_ZONE_LIMIT_ATTR_SET_REQ: Contains either
> + * OVS_CT_ZONE_LIMIT_ATTR_DEFAULT_LIMIT or a pair of
> + * OVS_CT_ZONE_LIMIT_ATTR_ZONE and OVS_CT_ZONE_LIMIT_ATTR_LIMIT.
> + * @OVS_CT_ZONE_LIMIT_ATTR_DEL_REQ: Contains OVS_CT_ZONE_LIMIT_ATTR_ZONE.
> + * @OVS_CT_ZONE_LIMIT_ATTR_GET_REQ: Contains OVS_CT_ZONE_LIMIT_ATTR_ZONE.
> + * @OVS_CT_ZONE_LIMIT_ATTR_GET_RLY: Contains either
> + * OVS_CT_ZONE_LIMIT_ATTR_DEFAULT_LIMIT or a triple of
> + * OVS_CT_ZONE_LIMIT_ATTR_ZONE, OVS_CT_ZONE_LIMIT_ATTR_LIMIT and
> + * OVS_CT_ZONE_LIMIT_ATTR_COUNT.
> + */
> +enum ovs_ct_limit_option_attr {
> +       OVS_CT_LIMIT_OPTION_ATTR_UNSPEC,
> +       OVS_CT_ZONE_LIMIT_ATTR_SET_REQ, /* Nested OVS_CT_ZONE_LIMIT_ATTR_*
> +                                        * attributes. */
> +       OVS_CT_ZONE_LIMIT_ATTR_DEL_REQ, /* Nested OVS_CT_ZONE_LIMIT_ATTR_*
> +                                        * attributes. */
> +       OVS_CT_ZONE_LIMIT_ATTR_GET_REQ, /* Nested OVS_CT_ZONE_LIMIT_ATTR_*
> +                                        * attributes. */
> +       OVS_CT_ZONE_LIMIT_ATTR_GET_RLY, /* Nested OVS_CT_ZONE_LIMIT_ATTR_*

This option looks redundant to me, can we just use ovs_ct_limit_cmd
and have nested attributes with ovs_ct_zone_limit_attr as parameters ?
I do not see need for ovs_ct_limit_attr either, These changes would
simplify the interface.

> +                                        * attributes. */
> +       __OVS_CT_LIMIT_OPTION_ATTR_MAX
> +};
> +
> +#define OVS_CT_LIMIT_OPTION_ATTR_MAX (__OVS_CT_LIMIT_OPTION_ATTR_MAX - 1)
> +
> +enum ovs_ct_zone_limit_attr {
> +       OVS_CT_ZONE_LIMIT_ATTR_UNSPEC,
> +       OVS_CT_ZONE_LIMIT_ATTR_DEFAULT_LIMIT,   /* u32 default conntrack limit
> +                                                * for all zones. */
> +       OVS_CT_ZONE_LIMIT_ATTR_ZONE,            /* u16 conntrack zone id. */
> +       OVS_CT_ZONE_LIMIT_ATTR_LIMIT,           /* u32 max number of conntrack
> +                                                * entries allowed in the
> +                                                * corresponding zone. */
> +       OVS_CT_ZONE_LIMIT_ATTR_COUNT,           /* u32 number of conntrack
> +                                                * entries in the corresponding
> +                                                * zone. */
> +       __OVS_CT_ZONE_LIMIT_ATTR_MAX
> +};
> +
> +#define OVS_CT_ZONE_LIMIT_ATTR_MAX (__OVS_CT_ZONE_LIMIT_ATTR_MAX - 1)
> +
>  #endif /* _LINUX_OPENVSWITCH_H */
> --
> 2.7.4
>