netdev - RE: [Intel-wired-lan] [PATCH iwl-next 1/2] ice: Add direction metadata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 3 Jul 2023 11:50:44 +0000
From: "Buvaneswaran, Sujai" <sujai.buvaneswaran@...el.com>
To: Marcin Szycik <marcin.szycik@...ux.intel.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [Intel-wired-lan] [PATCH iwl-next 1/2] ice: Add direction
 metadata

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf Of
> Marcin Szycik
> Sent: Thursday, June 22, 2023 7:05 PM
> To: intel-wired-lan@...ts.osuosl.org
> Cc: netdev@...r.kernel.org
> Subject: [Intel-wired-lan] [PATCH iwl-next 1/2] ice: Add direction metadata
> 
> Currently it is possible to create a filter which breaks TX traffic, e.g.:
> 
> tc filter add dev $PF1 ingress protocol ip prio 1 flower ip_proto udp dst_port
> $PORT action mirred egress redirect dev $VF1_PR
> 
> This adds a rule which might match both TX and RX traffic, and in TX path the
> PF will actually receive the traffic, which breaks communication.
> 
> To fix this, add a match on direction metadata flag when adding a tc rule.
> 
> Because of the way metadata is currently handled, a duplicate lookup word
> would appear if VLAN metadata is also added. The lookup would still work
> correctly, but one word would be wasted. To prevent it, lookup 0 now always
> contains all metadata. When any metadata needs to be added, it is added to
> lookup 0 and lookup count is not incremented. This way, two flags residing in
> the same word will take up one word, instead of two.
> 
> Note: the drop action is also affected, i.e. it will now only work in one
> direction.
> 
> Signed-off-by: Marcin Szycik <marcin.szycik@...ux.intel.com>
> ---
>  .../ethernet/intel/ice/ice_protocol_type.h    |  1 +
>  drivers/net/ethernet/intel/ice/ice_switch.c   | 11 ++++--
>  drivers/net/ethernet/intel/ice/ice_switch.h   |  1 +
>  drivers/net/ethernet/intel/ice/ice_tc_lib.c   | 34 +++++++++----------
>  4 files changed, 28 insertions(+), 19 deletions(-)
> 
Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@...el.com>