linux-kernel - Re: [v4,iproute2-next 1/2] iproute2-next:tc:action: add a gate control action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 06 May 2020 14:54:26 +0200
From:   Davide Caratti <dcaratti@...hat.com>
To:     Po Liu <Po.Liu@....com>, dsahern@...il.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Cc:     vinicius.gomes@...el.com, stephen@...workplumber.org,
        davem@...emloft.net, vlad@...lov.dev, claudiu.manoil@....com,
        vladimir.oltean@....com, alexandru.marginean@....com
Subject: Re: [v4,iproute2-next 1/2] iproute2-next:tc:action: add a gate
 control action

On Wed, 2020-05-06 at 16:40 +0800, Po Liu wrote:
> Introduce a ingress frame gate control flow action.
[...]

hello Po Liu,

[...]

> +create_entry:
> +			e = create_gate_entry(gate_state, interval,
> +					      ipv, maxoctets);
> +			if (!e) {
> +				fprintf(stderr, "gate: not enough memory\n");
> +				free_entries(&gate_entries);
> +				return -1;
> +			}
> +
> +			list_add_tail(&e->list, &gate_entries);
> +			entry_num++;
> +
> +		} else if (matches(*argv, "reclassify") == 0 ||
> +			   matches(*argv, "drop") == 0 ||
> +			   matches(*argv, "shot") == 0 ||
> +			   matches(*argv, "continue") == 0 ||
> +			   matches(*argv, "pass") == 0 ||
> +			   matches(*argv, "ok") == 0 ||
> +			   matches(*argv, "pipe") == 0 ||
> +			   matches(*argv, "goto") == 0) {
> +			if (parse_action_control(&argc, &argv,
> +						 &parm.action, false)) {
> +				free_entries(&gate_entries);
> +				return -1;
> +			}
> +		} else if (matches(*argv, "help") == 0) {
> +			usage();
> +		} else {
> +			break;
> +		}
> +
> +		argc--;
> +		argv++;
> +	}
> +
> +	parse_action_control_dflt(&argc, &argv, &parm.action,
> +				  false, TC_ACT_PIPE);

it seems that the control action is parsed twice, and the first time it
does not allow "jump" and "trap". Is that intentional? IOW, are there some
"act_gate" configurations that don't allow jump or trap?

I don't see anything similar in kernel act_gate.c, where tcf_gate_act()
can return TC_ACT_SHOT or whatever is written in parm.action. That's why
I'm asking, if these two control actions are forbidden you should let the
kernel return -EINVAL with a proper extack in tcf_gate_init(). Can you
please clarify?

thank you in advance!
-- 
davide