linux-kernel - RE: [EXT] Re: [v4,iproute2-next 1/2] iproute2-next:tc:action: add a gate control action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 7 May 2020 02:28:10 +0000
From:   Po Liu <po.liu@....com>
To:     Davide Caratti <dcaratti@...hat.com>,
        "dsahern@...il.com" <dsahern@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "vinicius.gomes@...el.com" <vinicius.gomes@...el.com>,
        "stephen@...workplumber.org" <stephen@...workplumber.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "vlad@...lov.dev" <vlad@...lov.dev>,
        Claudiu Manoil <claudiu.manoil@....com>,
        Vladimir Oltean <vladimir.oltean@....com>,
        Alexandru Marginean <alexandru.marginean@....com>
Subject: RE: [EXT] Re: [v4,iproute2-next 1/2] iproute2-next:tc:action: add a
 gate control action

Hi Davide,


> -----Original Message-----
> From: Davide Caratti <dcaratti@...hat.com>
> Sent: 2020年5月6日 20:54
> To: Po Liu <po.liu@....com>; dsahern@...il.com; linux-
> kernel@...r.kernel.org; netdev@...r.kernel.org
> Cc: vinicius.gomes@...el.com; stephen@...workplumber.org;
> davem@...emloft.net; vlad@...lov.dev; Claudiu Manoil
> <claudiu.manoil@....com>; Vladimir Oltean <vladimir.oltean@....com>;
> Alexandru Marginean <alexandru.marginean@....com>
> Subject: [EXT] Re: [v4,iproute2-next 1/2] iproute2-next:tc:action: add a
> gate control action
> 
> Caution: EXT Email
> 
> On Wed, 2020-05-06 at 16:40 +0800, Po Liu wrote:
> > Introduce a ingress frame gate control flow action.
> [...]
> 
> hello Po Liu,
> 
> [...]
> 
> > +create_entry:
> > +                     e = create_gate_entry(gate_state, interval,
> > +                                           ipv, maxoctets);
> > +                     if (!e) {
> > +                             fprintf(stderr, "gate: not enough memory\n");
> > +                             free_entries(&gate_entries);
> > +                             return -1;
> > +                     }
> > +
> > +                     list_add_tail(&e->list, &gate_entries);
> > +                     entry_num++;
> > +
> > +             } else if (matches(*argv, "reclassify") == 0 ||
> > +                        matches(*argv, "drop") == 0 ||
> > +                        matches(*argv, "shot") == 0 ||
> > +                        matches(*argv, "continue") == 0 ||
> > +                        matches(*argv, "pass") == 0 ||
> > +                        matches(*argv, "ok") == 0 ||
> > +                        matches(*argv, "pipe") == 0 ||
> > +                        matches(*argv, "goto") == 0) {
> > +                     if (parse_action_control(&argc, &argv,
> > +                                              &parm.action, false)) {
> > +                             free_entries(&gate_entries);
> > +                             return -1;
> > +                     }
> > +             } else if (matches(*argv, "help") == 0) {
> > +                     usage();
> > +             } else {
> > +                     break;
> > +             }
> > +
> > +             argc--;
> > +             argv++;
> > +     }
> > +
> > +     parse_action_control_dflt(&argc, &argv, &parm.action,
> > +                               false, TC_ACT_PIPE);
> 
> it seems that the control action is parsed twice, and the first time it does
> not allow "jump" and "trap". Is that intentional? IOW, are there some
> "act_gate" configurations that don't allow jump or trap?

It is allowed to jump and trap. I didn't notice it was loaded twice. I would correct here and remove one parse_action_control()
Thanks a lot!

> 
> I don't see anything similar in kernel act_gate.c, where tcf_gate_act() can
> return TC_ACT_SHOT or whatever is written in parm.action. That's why I'm
> asking, if these two control actions are forbidden you should let the kernel
> return -EINVAL with a proper extack in tcf_gate_init(). Can you please
> clarify?
> 
> thank you in advance!
> --
> davide
> 


Br,
Po Liu